Syntax errors prevented important parameters from being passed to oauth2_proxy, which could have permitted unauthorised access to services behind the proxy.