tsuru/tsuru-dashboard

OAuth callback URL is only formatted for HTTP

nettoclaudio opened this issue · 0 comments

The OAuth callback URL scheme is hardcoded for http (see the code snippet below).

callback_url = "http://{}/auth/callback/".format(self.request.META.get('HTTP_HOST'))

redirect_url = "http://{}/auth/callback/".format(request.META.get('HTTP_HOST'))

The URL scheme should be formatted based on:

  • the protocol used by app to run the server;
  • the request headers such as Forwarded or X-Forwarded-Proto whenever dashboard app is running behind a reverse proxy or load balancer.