diff --git a/handlers_test.go b/handlers_test.go
index 6e52a5fb720f67086eee8e3711e5558558f14f9d..cc36ffc9d148a5128f425d9d29c6fc8225a05923 100644
--- a/handlers_test.go
+++ b/handlers_test.go
@@ -247,10 +247,6 @@ func TestAuthorizationURL(t *testing.T) {
 		ExpectedURL  string
 		ExpectedCode int
 	}{
-		{
-			URL:          "/",
-			ExpectedCode: http.StatusOK,
-		},
 		{
 			URL:          "/admin",
 			ExpectedURL:  "/oauth/authorize?state=L2FkbWlu",
@@ -271,11 +267,20 @@ func TestAuthorizationURL(t *testing.T) {
 			ExpectedURL:  "/oauth/authorize?state=L2FkbWluP3Rlc3Q9eWVzJnRlc3QxPXRlc3Q=",
 			ExpectedCode: http.StatusTemporaryRedirect,
 		},
+		{
+			URL:          "/oauth/test",
+			ExpectedCode: http.StatusNotFound,
+		},
+		{
+			URL:          "/oauth/callback/..//test",
+			ExpectedCode: http.StatusNotFound,
+		},
 	}
 	for i, x := range cs {
 		resp, _ := client.Get(u + x.URL)
 		assert.Equal(t, x.ExpectedCode, resp.StatusCode, "case %d, expect: %v, got: %s", i, x.ExpectedCode, resp.StatusCode)
 		assert.Equal(t, x.ExpectedURL, resp.Header.Get("Location"), "case %d, expect: %v, got: %s", i, x.ExpectedURL, resp.Header.Get("Location"))
+		assert.Empty(t, resp.Header.Get(testProxyAccepted))
 	}
 }
 
diff --git a/middleware.go b/middleware.go
index c82854d5fb65ca7afab2b6dd87f3bb7d044c0ec2..fb06824e4f3b0558fb6116cb2412f39a0b75492b 100644
--- a/middleware.go
+++ b/middleware.go
@@ -96,6 +96,7 @@ func (r *oauthProxy) entrypointMiddleware() gin.HandlerFunc {
 	return func(cx *gin.Context) {
 		// step: we can skip if under oauth prefix
 		if strings.HasPrefix(cx.Request.URL.Path, oauthURL) {
+			cx.Abort()
 			return
 		}