Authelia bypass rule advice for nextcloud

Hello guys,

I've just setup Authelia with OIDC and duo for Jellyfin and Nextcloud. Everything is working great, except that i cannot use android or desktop apps (but that's fine, it seems not doable without exposing APIs that i'd rather not).

I would like however to be able to share external links to non authenticated users as read only. What i did is :

- Share a public link from nextcloud

- Access that link from a browser which isn't authenticated to authelia

- Check browser dev tools for every get command when accessing nextcloud

- Add every folder that browser tried to fetch from nextcloud to authelia bypass configuration

Now i can access everything that i shared through the link without an authelia cookie, but i want to be sure those aren't major security flaw. My authelia rules for nextcloud are the following :

- domain:

- "nextcloud.example.com"

policy: bypass

resources:

- "^/s/"

- "^/public.php/"

- "^/apps/"

- "^/core"

- "^/dist"

- "^/js"

- "^/viewer"

- domain:

- "nextcloud.example.com"

policy: two_factor

I'll take any advices you guys have :).