{"record":{"id":"27c73f8988f12c25","repo":"siyuan-note/siyuan","slug":"a-public-https-oidc-redirect-url-is-required-for-r","errorCode":null,"errorMessage":"A public HTTPS OIDC redirect URL is required for remote access","messagePattern":"A public HTTPS OIDC redirect URL is required for remote access","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":630,"sourceCode":"\tif !util.IsLocalHost(host) {\n\t\treturn \"\", errors.New(\"A loopback OIDC redirect URL is required for local access\")\n\t}\n\treturn scheme + \"://\" + host + \"/api/system/oidc/callback\", nil\n}\n\nfunc oidcValidationRedirectURL(c *gin.Context, config *conf.OIDC, mobile bool) (string, error) {\n\tif mobile {\n\t\treturn oidcMobileRedirectURL, nil\n\t}\n\tif config.RedirectURL != \"\" {\n\t\treturn validatePublicOIDCRedirectURL(config.RedirectURL)\n\t}\n\treturn effectiveOIDCRedirectURL(c, oidcFlowDesktop)\n}\n\nfunc validatePublicOIDCRedirectURL(redirectURL string) (string, error) {\n\tif redirectURL == \"\" {\n\t\treturn \"\", errors.New(\"A public HTTPS OIDC redirect URL is required for remote access\")\n\t}\n\tparsed, err := url.Parse(redirectURL)\n\tif err != nil || parsed.Scheme == \"\" || parsed.Host == \"\" || parsed.Path != \"/api/system/oidc/callback\" ||\n\t\tparsed.User != nil || parsed.RawQuery != \"\" || parsed.Fragment != \"\" {\n\t\treturn \"\", errors.New(\"OIDC redirect URL must end with /api/system/oidc/callback\")\n\t}\n\tif parsed.Scheme != \"https\" {\n\t\treturn \"\", errors.New(\"Public OIDC redirect URL must use HTTPS\")\n\t}\n\treturn parsed.String(), nil\n}\n\nfunc getOIDCProvider(ctx context.Context, redirectURL string) (*oidc_provider.Provider, error) {\n\tversion := oidcConfigurationVersion(Conf.GetOIDC())\n\tkey := version + \"\\x00\" + redirectURL\n\toidcProviders.Lock()\n\tif oidcProviders.version != version {\n\t\toidcProviders.version = version","sourceCodeStart":612,"sourceCodeEnd":648,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L612-L648","documentation":"Thrown by validatePublicOIDCRedirectURL when the redirect URL is empty but a public redirect URL is required. The kernel refuses to derive a loopback URL for remote (non-loopback / Docker) access because the IdP must redirect to a stable, publicly-reachable HTTPS endpoint configured by the operator.","triggerScenarios":"POST /api/system/oidc/start with flow=web from a non-local client while Conf.OIDC.RedirectURL is unset (effectiveOIDCRedirectURL -> validatePublicOIDCRedirectURL at oidc.go:602); or the validate flow reaching oidcValidationRedirectURL with a candidate config whose RedirectURL is empty.","commonSituations":"Deploying SiYuan behind a reverse proxy or in Docker and enabling OIDC without filling the public redirect URL field; migrating from loopback-only to remote access without updating config.","solutions":["Set Conf.OIDC.RedirectURL to a public HTTPS URL of the form https://<host>/api/system/oidc/callback in Settings - About - OIDC.","Register that exact URL in the IdP's allowed redirect URIs.","If you only need local access, reach SiYuan via 127.0.0.1/localhost so the loopback-derived URL is used instead."],"exampleFix":"// before\nRedirectURL: \"\"\n// after\nRedirectURL: \"https://notes.example.com/api/system/oidc/callback\"","handlingStrategy":"validation","validationCode":"// Before allowing a remote web-flow start, ensure a public HTTPS redirect URL is configured.\nfunc ensurePublicRedirectURL(remote bool) error {\n    if !remote {\n        return nil // loopback access derives its own URL\n    }\n    if Conf.OIDC.RedirectURL == \"\" {\n        return errors.New(\"set a public HTTPS OIDC RedirectURL before exposing SiYuan remotely\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure Conf.OIDC.RedirectURL before switching SiYuan to remote/Docker exposure.","Keep localhost/127.0.0.1 access for local-only testing so the loopback URL is used.","Validate the OIDC config through the admin UI's validate flow before going live."],"tags":["oidc","configuration","redirect-url","security","remote-access"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}