BookStackApp/BookStack · error · InvalidArgumentException

Endpoint value for "{$prop}" must start with https://

Error message

Endpoint value for "{$prop}" must start with https://

What it means

During full validation, any of tokenEndpoint, authorizationEndpoint or userinfoEndpoint that is set as a string must start with https://. This blocks downgraded/insecure endpoint URLs that could leak authorization codes or tokens. The message names the offending property.

Source

Thrown at app/Access/Oidc/OidcProviderSettings.php:87

     * Perform a full validation on these settings.
     *
     * @throws InvalidArgumentException
     */
    public function validate(): void
    {
        $this->validateInitial();

        $required = ['keys', 'tokenEndpoint', 'authorizationEndpoint'];
        foreach ($required as $prop) {
            if (empty($this->$prop)) {
                throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");
            }
        }

        $endpointProperties = ['tokenEndpoint', 'authorizationEndpoint', 'userinfoEndpoint'];
        foreach ($endpointProperties as $prop) {
            if (is_string($this->$prop) && !str_starts_with($this->$prop, 'https://')) {
                throw new InvalidArgumentException("Endpoint value for \"{$prop}\" must start with https://");
            }
        }
    }

    /**
     * Discover and autoload settings from the configured issuer.
     *
     * @throws OidcIssuerDiscoveryException
     */
    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes): void
    {
        try {
            $cacheKey = 'oidc-discovery::' . $this->issuer;
            $discoveredSettings = $cache->remember($cacheKey, $cacheMinutes * 60, function () use ($httpClient) {
                return $this->loadSettingsFromIssuerDiscovery($httpClient);
            });
            $this->applySettingsFromArray($discoveredSettings);
        } catch (ClientExceptionInterface $exception) {

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Set the named endpoint to its https:// URL in .env and clear config cache.
2. If discovery returns http URLs, fix the IdP/proxy so its discovery document advertises https (set forwarded headers / public URL settings on the IdP).
3. Terminate TLS properly at the IdP or reverse proxy so endpoint URLs are https in the metadata.
4. Confirm the final validated config with php artisan config:show oidc.

Example fix

# before
OIDC_TOKEN_ENDPOINT=http://idp.example.com/token
# after
OIDC_TOKEN_ENDPOINT=https://idp.example.com/token

foreach (['token_endpoint','authorization_endpoint','userinfo_endpoint'] as $k) {
    $v = config("oidc.$k");
    if (is_string($v) && !str_starts_with($v, 'https://')) {
        throw new RuntimeException("oidc.$k must use https://");
    }
}

try {
    $settings->validate();
} catch (InvalidArgumentException $e) {
    Log::error('OIDC endpoint not https: ' . $e->getMessage());
}

When it happens

Trigger: Configuring oidc.token_endpoint / authorization_endpoint / userinfo_endpoint with http:// URLs, or discovery returning an endpoint that is http:// (e.g. IdP behind a TLS-terminating proxy advertising http URLs in its discovery document).

Common situations: Self-hosted Keycloak/Auth0-like service behind an offloading proxy that publishes http endpoint URLs; hand-typed endpoint values missing the 's'; dev IdP URLs copied into production config.

Related errors

• Issuer value must start with https://
• Failed to read signing key with error:
• Missing or non-matching token issuer value
• Missing required configuration "{$prop}" value
• Unexpected issuer value found on discovery response

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/0da8f6d68a482ba0. Report an issue: GitHub.