diff --git a/services/proxy/pkg/middleware/authentication.go b/services/proxy/pkg/middleware/authentication.go
index 2ee63fe34..3e851d0ad 100644
--- a/services/proxy/pkg/middleware/authentication.go
+++ b/services/proxy/pkg/middleware/authentication.go
@@ -65,9 +65,11 @@ const (
 )
 
 // Authenticator is the common interface implemented by all request authenticators.
-// The Authenticator may augment the request with user info or anything related to the
-// authentication and return the augmented request.
+
 type Authenticator interface {
+	// Authenticate is used to authenticate incoming HTTP requests.
+	// The Authenticator may augment the request with user info or anything related to the
+	// authentication and return the augmented request.
 	Authenticate(*http.Request) (*http.Request, bool)
 }
 
diff --git a/services/proxy/pkg/middleware/basic_auth.go b/services/proxy/pkg/middleware/basic_auth.go
index eaccd7042..eb8f79847 100644
--- a/services/proxy/pkg/middleware/basic_auth.go
+++ b/services/proxy/pkg/middleware/basic_auth.go
@@ -8,6 +8,7 @@ import (
 	"github.com/owncloud/ocis/v2/services/proxy/pkg/user/backend"
 )
 
+// BasicAuthenticator is the authenticator responsible for HTTP Basic authentication.
 type BasicAuthenticator struct {
 	Logger        log.Logger
 	UserProvider  backend.UserBackend
diff --git a/services/proxy/pkg/middleware/oidc_auth.go b/services/proxy/pkg/middleware/oidc_auth.go
index a59a3b245..36adeeb29 100644
--- a/services/proxy/pkg/middleware/oidc_auth.go
+++ b/services/proxy/pkg/middleware/oidc_auth.go
@@ -30,6 +30,7 @@ type OIDCProvider interface {
 	UserInfo(ctx context.Context, ts oauth2.TokenSource) (*gOidc.UserInfo, error)
 }
 
+// NewOIDCAuthenticator returns a ready to use authenticator which can handle OIDC authentication.
 func NewOIDCAuthenticator(logger log.Logger, tokenCacheTTL int, oidcHTTPClient *http.Client, oidcIss string, providerFunc func() (OIDCProvider, error),
 	jwksOptions config.JWKS, accessTokenVerifyMethod string) OIDCAuthenticator {
 	tokenCache := osync.NewCache(tokenCacheTTL)
@@ -47,6 +48,7 @@ func NewOIDCAuthenticator(logger log.Logger, tokenCacheTTL int, oidcHTTPClient *
 	}
 }
 
+// OIDCAuthenticator is an authenticator responsible for OIDC authentication.
 type OIDCAuthenticator struct {
 	Logger                  log.Logger
 	HTTPClient              *http.Client
@@ -239,7 +241,10 @@ func (m OIDCAuthenticator) getProvider() OIDCProvider {
 
 func (m OIDCAuthenticator) Authenticate(r *http.Request) (*http.Request, bool) {
 	// there is no bearer token on the request,
-	if !m.shouldServe(r) {
+	if !m.shouldServe(r) || isPublicPath(r.URL.Path) {
+		// The authentication of public path requests is handled by another authenticator.
+		// Since we can't guarantee the order of execution of the authenticators, we better
+		// implement an early return here for paths we can't authenticate in this authenticator.
 		return nil, false
 	}