Passport Strategy redirect_uri uses HTTP instead of HTTPS

[rafaelavd]

Hi.

After upgrading to openid-client version 6.1.1 I am trying to authenticate against an Azure App Registration, following example https://github.com/panva/openid-client/blob/main/examples/passport.ts, with the only difference being on the callback endpoint:

app.get('/', (req, res, next) => {
  passport.authenticate(server.hostname, async function (err, passportUser, info) {
    res.end()
  })(req, res, next)
})

I get the following error (when invoking passport.authenticate above) to get the user from the data that Azure sends to the callback endpoint:

AADSTS500112: The reply address 'http://[APP_URL]' does not match the reply address 'https://[APP_URL]' provided when requesting Authorization code. [...]

notice the http on reply address instead of https.

The application is running on a cloud server on HTTPS. I made sure that App Registration on Azure has the Redirect URI defined to https://[APP_URL].

If I switch to run the application locally on HTTP (http://localhost), and define Redirect URI to http://localhost, it works.

This is only happening since upgrading to 6.1.1.

Since this is likely not to be a bug on openid-client I am posting as a question.

Thanks in advance for the help.

[panva]

Do you have your express app set to trust proxy and is your tls offloading proxy forwarding an x-forwarded-proto header?

[panva]

To explain, the currentUrl prototype method on the Strategy is used to determine the current URL the strategy is executed on, ergo the URL that is used as the redirect_uri token endpoint parameter. And in tls-offloading proxy setups it just depends on express configuration to be in order.

openid-client/src/passport.ts

Lines 378 to 389 in 7405570

	/**
	* Return the current request URL.
	*
	* - Its `searchParams` are used as the authorization response parameters when
	* the response type used by the client is `code`
	* - Its value stripped of `searchParams` and `hash` is used as the
	* `redirect_uri` authorization code grant token endpoint parameter unless
	* callbackURL was specified in the Strategy constructor
	*/
	currentUrl(req: express.Request): URL {
	return new URL(`${req.protocol}://${req.host}${req.url}`)
	}

[panva]

So you have two options to remedy

• fix your proxy setup as per the express guide above (i.e. setting X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers at your reverse proxy)
• overwrite the currentUrl method on the Strategy instance to return the current URL

[rafaelavd]

Went with option 2 and it worked! Thanks.
However reading on the docs of currentUrl method above:

[...] unless callbackURL was specified in the Strategy constructor

I was in fact specifying callbackURL on the Strategy constructor to the correct URL https://[APP_URL]. So I am not sure there is an inconsistency on the documentation?

Thanks again for the quick support!

[panva]

Absolutely, the docs don't reflect the state of implementation atm. I'll have a look at it later.