jennie/ghostguild-org
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ensure OIDC endpoints use https behind reverse proxy

Browse source 
Set x-forwarded-proto header on requests before passing to
oidc-provider so generated URLs use https:// in production.
This commit is contained in:
Jennie Robinson Faber 2026-03-01 16:49:40 +00:00
parent f43d1bf500
commit a3b4f1118c
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
server/routes/.well-known/openid-configuration.get.ts
View file

@ -14,6 +14,11 @@ export default defineEventHandler(async (event) => {
// The provider expects the path relative to its root // The provider expects the path relative to its root
req.url = "/.well-known/openid-configuration"; req.url = "/.well-known/openid-configuration";
// Ensure the provider sees https when behind Traefik
if (!req.headers["x-forwarded-proto"]) {
req.headers["x-forwarded-proto"] = "https";
}
const callback = provider.callback() as Function; const callback = provider.callback() as Function;
await new Promise<void>((resolve, reject) => { await new Promise<void>((resolve, reject) => {
callback(req, res, (err: unknown) => { callback(req, res, (err: unknown) => {

5
server/routes/oidc/[...].ts
View file

@ -17,6 +17,11 @@ export default defineEventHandler(async (event) => {
// The provider's routes config includes the /oidc prefix, // The provider's routes config includes the /oidc prefix,
// so pass the full path through without stripping. // so pass the full path through without stripping.
// Ensure the provider sees https when behind Traefik
if (!req.headers["x-forwarded-proto"]) {
req.headers["x-forwarded-proto"] = "https";
}
// Hand off to oidc-provider's Connect-style callback // Hand off to oidc-provider's Connect-style callback
const callback = provider.callback() as Function; const callback = provider.callback() as Function;
await new Promise<void>((resolve, reject) => { await new Promise<void>((resolve, reject) => {