{"record":{"id":"40d185bb4cb12da1","repo":"siyuan-note/siyuan","slug":"public-oidc-redirect-url-must-use-https","errorCode":null,"errorMessage":"Public OIDC redirect URL must use HTTPS","messagePattern":"Public OIDC redirect URL must use HTTPS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":638,"sourceCode":"\t\treturn oidcMobileRedirectURL, nil\n\t}\n\tif config.RedirectURL != \"\" {\n\t\treturn validatePublicOIDCRedirectURL(config.RedirectURL)\n\t}\n\treturn effectiveOIDCRedirectURL(c, oidcFlowDesktop)\n}\n\nfunc validatePublicOIDCRedirectURL(redirectURL string) (string, error) {\n\tif redirectURL == \"\" {\n\t\treturn \"\", errors.New(\"A public HTTPS OIDC redirect URL is required for remote access\")\n\t}\n\tparsed, err := url.Parse(redirectURL)\n\tif err != nil || parsed.Scheme == \"\" || parsed.Host == \"\" || parsed.Path != \"/api/system/oidc/callback\" ||\n\t\tparsed.User != nil || parsed.RawQuery != \"\" || parsed.Fragment != \"\" {\n\t\treturn \"\", errors.New(\"OIDC redirect URL must end with /api/system/oidc/callback\")\n\t}\n\tif parsed.Scheme != \"https\" {\n\t\treturn \"\", errors.New(\"Public OIDC redirect URL must use HTTPS\")\n\t}\n\treturn parsed.String(), nil\n}\n\nfunc getOIDCProvider(ctx context.Context, redirectURL string) (*oidc_provider.Provider, error) {\n\tversion := oidcConfigurationVersion(Conf.GetOIDC())\n\tkey := version + \"\\x00\" + redirectURL\n\toidcProviders.Lock()\n\tif oidcProviders.version != version {\n\t\toidcProviders.version = version\n\t\toidcProviders.items = map[string]*oidc_provider.Provider{}\n\t}\n\tif provider := oidcProviders.items[key]; provider != nil {\n\t\toidcProviders.Unlock()\n\t\treturn provider, nil\n\t}\n\toidcProviders.Unlock()\n\tdiscoveryContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L620-L656","documentation":"The redirect URL has the correct path but its scheme is not https (typically http). For remote/public access the kernel mandates TLS so the authorization code is never transported over plaintext, even if TLS is terminated upstream.","triggerScenarios":"validatePublicOIDCRedirectURL receives a URL like http://notes.example.com/api/system/oidc/callback while the request is non-local.","commonSituations":"Operator configures the http form by mistake behind a TLS-terminating proxy; a local-only http setup was later exposed remotely.","solutions":["Change the redirect URL scheme to https.","Put SiYuan behind a TLS-terminating reverse proxy and use the https URL.","For pure local testing, access SiYuan via loopback so the public-URL path is not taken."],"exampleFix":"// before\nRedirectURL: \"http://notes.example.com/api/system/oidc/callback\"\n// after\nRedirectURL: \"https://notes.example.com/api/system/oidc/callback\"","handlingStrategy":"validation","validationCode":"// Require https for any public redirect URL before persisting it.\nif u, err := url.Parse(redirectURL); err == nil && u.Scheme != \"https\" && isPublicHost(u.Host) {\n    return errors.New(\"public OIDC redirect URL must use HTTPS\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Terminate TLS at the reverse proxy and configure the https URL even if SiYuan itself serves http.","Reserve http URLs for loopback-only local testing.","Validate via the admin UI's validate flow after changing scheme."],"tags":["oidc","configuration","redirect-url","tls","security"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}