Back

[SOLVED] Unsecure callback sent to OAuth provider due to reverse proxy

  • 0
  • Flutter
  • Accounts
hernik
29 Jul, 2023, 13:58

Hey, I'm running Appwrite and my Flutter web app (running live for debugging using flutter run) behind an NGINX reverse proxy and it seems that due to the reverse proxy handling the HTTPS traffic and decrypting it for the apps, when I try to sign in using createOAuth2Session, it passes an unsecured callback URL to the provider, meaning I cannot continue signing in. This is probably the same issue as https://github.com/appwrite/appwrite/issues/5545 but I didn't find any solution there. Is there anything I can do to force it to pass HTTPS?

TL;DR
Issue: When using an NGINX reverse proxy for Appwrite and a Flutter web app, the callback URL sent to the OAuth provider is unsecured, preventing successful sign-in. Solution: Make sure to switch the port to the HTTPS port in the proxy_pass directive when changing from HTTP to HTTPS in the proxy. Also, ensure that the proxy_pass directive includes HTTPS. Refer to this link for more information on proxying to Appwrite using HTTPS: https://github.com/appwrite/appwrite/issues/5545#issuecomment-1553276914
D5
29 Jul, 2023, 14:01

If you use default https port I think it will use https

Drake
29 Jul, 2023, 14:46
hernik
29 Jul, 2023, 15:00

I didn't really understand what proxying to Appwrite using HTTPS meant

Drake
29 Jul, 2023, 15:00

Your proxy_pass directive should include https

hernik
29 Jul, 2023, 15:04

Oh ok, am I supposed to change some setting related to HTTPS in appwrite, because now every page returns 404 page not found

hernik
29 Jul, 2023, 15:04

Found only something about _APP_OPTIONS_FORCE_HTTPS, but it says it only works when the app is using 80 and 443 ports, which I am not

Drake
29 Jul, 2023, 15:10

No nothing in Appwrite. What ports is Appwrite running on? What exactly is your proxy pass directive?

hernik
29 Jul, 2023, 15:17

Yeah I'm just stupid, I forgot to switch the port to the https port when I was changing http to https in the proxy_pass 🤦‍♂️

hernik
29 Jul, 2023, 15:19

Ok yeah it all works now, thank you very much 🙏

Drake
29 Jul, 2023, 15:20

[SOLVED] Unsecure callback sent to OAuth provider due to reverse proxy

Reply

Reply to this thread by joining our Discord

Reply on Discord

Need support?

Join our Discord

Get community support by joining our Discord server.

Join Discord

Get premium support

Join Appwrite Pro and get email support from our team.

Learn more