Guess that just means, that the call back request coming from the auth service got answered by nginx and forwarded locally from nginx over 127.0.0.1 to port 3000 (oauth plugin) …
But never mind, we found the bug at the auth provider. They configured a wrong auth method for us …