OIDCXForwardedHeaders not being taken into account since 2.4.16

[maltesmann]

Hi there,

I am using mod_auth_openidc behind a reverse proxy as described here: https://github.com/OpenIDC/mod_auth_openidc/wiki#8-how-do-i-run-mod_auth_openidc-behind-a-reverse-proxy

But since upgrading from 2.4.15.7 → 2.4.16 I get an 500 Internal Server Error accessing my site. The error log says:

Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Host received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Port received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Proto received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/handle/request.c"] [line 61] [level 3] oidc_request_check_cookie_domain: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of th
e URL being accessed (http): the "state" and "session" cookies will not be shared between the two!

But my configuration hasn't changed and still looks like this:

<VirtualHost *:80>

  [...]
  OIDCRedirectURI https://[...]/protected/redirect_uri
  [...]
  OIDCXForwardedHeaders X-Forwarded-Proto
  
  ProxyRequests on
  ProxyPreserveHost Off

  <Location /ui>
    AuthType openid-connect
    <RequireAll>
      Require valid-user
    </RequireAll>
    ProxyPass http://localhost:9000
    ProxyPassReverse http://localhost:9000
  </Location>

  [...]

The relevant Headers from the reverse proxy are:

Host: [...]
X-Forwarded-Proto: https
X-Forwarded-Host: [...]
X-Forwarded-Port: 443

I already tried to also configure the X-Forwarded-Host and X-Forwarded-Port headers, but that doesn't change anything.

Downgrading back to 2.4.15.7 solves the issue.

Could this be a bug in 2.4.16 or was there some change in configuration I am missing?

[zandbelt]

that's a bug indeed, we'll release 2.4.16.1 and pull 2.4.16, thanks for reporting