Problem/Motivation

For the Redirect URL https is missing in the Configuration Form

Steps to reproduce

Add any Oauth Provider with the machine name and the Redirect URL generates without HTTPS

Proposed resolution

Add the 'https' => TRUE, in the getRedirect() function

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#10 openid_connect_enforce_redirect_https_3460749_10.patch4.52 KBniels de ruijter
#10 Screenshot 2026-03-12 at 14.17.54.png15.58 KBniels de ruijter
#2 enforce_redirect_https.patch1.3 KBsanthosh@21

Issue fork openid_connect-3460749

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

santhosh@21 created an issue. See original summary.

santhosh@21’s picture

santhosh@21 commented
StatusFileSize
new enforce_redirect_https.patch1.3 KB

sarwan_verma made their first commit to this issue’s fork.

sarwan_verma opened merge request !115

sarwan_verma’s picture

sarwan_verma commented
Status: Active » Needs review

Hi @santhosh@21,

I have created MR!3 for the above patch, Please review it once.

santhosh@21’s picture

santhosh@21 commented

Hi sarwan_verma

The MR looks good and no issues.

sboto’s picture

sboto commented

So is this issue fixed? Is there a way I can configure the redirect uri to use https? The drupal site is dockerized and deployed on azure securely with https already. Where in the code and in which file can I find and configure it?

pfrilling’s picture

pfrilling
Location Minster, OH
commented
Status: Needs review » Needs work

Reading through the spec for redirect uri https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest, I'm not sure we should enforce https.

REQUIRED. Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider, with the matching performed as described in Section 6.2.1 of [RFC3986] (Simple String Comparison). When using this flow, the Redirection URI SHOULD use the https scheme; however, it MAY use the http scheme, provided that the Client Type is confidential, as defined in Section 2.1 of OAuth 2.0, and provided the OP allows the use of http Redirection URIs in this case. Also, if the Client is a native application, it MAY use the http scheme with localhost or the IP loopback literals 127.0.0.1 or [::1] as the hostname. The Redirection URI MAY use an alternate scheme, such as one that is intended to identify a callback into a native application.

I think the better approach would be to add a new option that allows an administrator to enforce https if they choose.

niels de ruijter made their first commit to this issue’s fork.

niels de ruijter’s picture

niels de ruijter commented
Version: 3.0.0-alpha3 » 3.x-dev
StatusFileSize
new Screenshot 2026-03-12 at 14.17.54.png15.58 KB
new openid_connect_enforce_redirect_https_3460749_10.patch4.52 KB

Made the enforcement of HTTPS an option like @pfrilling suggested.

Attached is a patch for use in composer patches. (MR diffs can change on any commit).

niels de ruijter’s picture

niels de ruijter commented
Status: Needs work » Needs review
webflo’s picture

webflo commented

I saw a similar issue in the OIDC AAD issue queue. #3124961: Enforce HTTPS

I think adding HTTPS at this link is just a cover up for badly configured reverse proxy settings. Described in https://www.drupal.org/project/openid_connect_windows_aad/issues/3124961...