{"record":{"id":"0da8f6d68a482ba0","repo":"BookStackApp/BookStack","slug":"endpoint-value-for-prop-must-start-with-https","errorCode":null,"errorMessage":"Endpoint value for \"{$prop}\" must start with https://","messagePattern":"Endpoint value for \"(.+?)\" must start with https://","errorType":"validation","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"app/Access/Oidc/OidcProviderSettings.php","lineNumber":87,"sourceCode":"     * Perform a full validation on these settings.\n     *\n     * @throws InvalidArgumentException\n     */\n    public function validate(): void\n    {\n        $this->validateInitial();\n\n        $required = ['keys', 'tokenEndpoint', 'authorizationEndpoint'];\n        foreach ($required as $prop) {\n            if (empty($this->$prop)) {\n                throw new InvalidArgumentException(\"Missing required configuration \\\"{$prop}\\\" value\");\n            }\n        }\n\n        $endpointProperties = ['tokenEndpoint', 'authorizationEndpoint', 'userinfoEndpoint'];\n        foreach ($endpointProperties as $prop) {\n            if (is_string($this->$prop) && !str_starts_with($this->$prop, 'https://')) {\n                throw new InvalidArgumentException(\"Endpoint value for \\\"{$prop}\\\" must start with https://\");\n            }\n        }\n    }\n\n    /**\n     * Discover and autoload settings from the configured issuer.\n     *\n     * @throws OidcIssuerDiscoveryException\n     */\n    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes): void\n    {\n        try {\n            $cacheKey = 'oidc-discovery::' . $this->issuer;\n            $discoveredSettings = $cache->remember($cacheKey, $cacheMinutes * 60, function () use ($httpClient) {\n                return $this->loadSettingsFromIssuerDiscovery($httpClient);\n            });\n            $this->applySettingsFromArray($discoveredSettings);\n        } catch (ClientExceptionInterface $exception) {","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Oidc/OidcProviderSettings.php#L69-L105","documentation":"During full validation, any of tokenEndpoint, authorizationEndpoint or userinfoEndpoint that is set as a string must start with https://. This blocks downgraded/insecure endpoint URLs that could leak authorization codes or tokens. The message names the offending property.","triggerScenarios":"Configuring oidc.token_endpoint / authorization_endpoint / userinfo_endpoint with http:// URLs, or discovery returning an endpoint that is http:// (e.g. IdP behind a TLS-terminating proxy advertising http URLs in its discovery document).","commonSituations":"Self-hosted Keycloak/Auth0-like service behind an offloading proxy that publishes http endpoint URLs; hand-typed endpoint values missing the 's'; dev IdP URLs copied into production config.","solutions":["Set the named endpoint to its https:// URL in .env and clear config cache.","If discovery returns http URLs, fix the IdP/proxy so its discovery document advertises https (set forwarded headers / public URL settings on the IdP).","Terminate TLS properly at the IdP or reverse proxy so endpoint URLs are https in the metadata.","Confirm the final validated config with php artisan config:show oidc."],"exampleFix":"# before\nOIDC_TOKEN_ENDPOINT=http://idp.example.com/token\n# after\nOIDC_TOKEN_ENDPOINT=https://idp.example.com/token","handlingStrategy":"validation","validationCode":"foreach (['token_endpoint','authorization_endpoint','userinfo_endpoint'] as $k) {\n    $v = config(\"oidc.$k\");\n    if (is_string($v) && !str_starts_with($v, 'https://')) {\n        throw new RuntimeException(\"oidc.$k must use https://\");\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    $settings->validate();\n} catch (InvalidArgumentException $e) {\n    Log::error('OIDC endpoint not https: ' . $e->getMessage());\n}","preventionTips":["Use https URLs for all OIDC endpoints in configuration.","Configure the IdP/proxy so its discovery document advertises https endpoints (proper forwarded headers, public URL).","Never copy http:// dev URLs into production config.","Re-validate config after any proxy/TLS topology change."],"tags":["configuration","https","oidc"],"backgroundTag":"insecure-url-rejected","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}