{"record":{"id":"53059c08c41c039e","repo":"netbirdio/netbird","slug":"oidc-requires-tls-use-port-443","errorCode":null,"errorMessage":"OIDC requires TLS — use port 443","messagePattern":"OIDC requires TLS — use port 443","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"proxy/internal/auth/middleware.go","lineNumber":197,"sourceCode":"\treturn false\n}\n\n// blockOIDCOnPlainHTTP fails fast when an OIDC-configured domain is hit\n// over plain HTTP. Most IdPs reject http:// redirect URIs, so surfacing\n// the misconfiguration here yields a clearer error than the IdP's\n// \"invalid redirect_uri\" round-trip.\nfunc (mw *Middleware) blockOIDCOnPlainHTTP(w http.ResponseWriter, r *http.Request, config DomainConfig) bool {\n\tif !requestIsPlainHTTP(r) {\n\t\treturn false\n\t}\n\tif !hasOIDCScheme(config.Schemes) {\n\t\treturn false\n\t}\n\tmw.logger.WithFields(log.Fields{\n\t\t\"host\":   r.Host,\n\t\t\"remote\": r.RemoteAddr,\n\t}).Warn(\"OIDC scheme reached on plain HTTP path; rejecting with 400 — use port 443\")\n\thttp.Error(w, \"OIDC requires TLS — use port 443\", http.StatusBadRequest)\n\treturn true\n}\n\nfunc (mw *Middleware) getDomainConfig(host string) (DomainConfig, bool) {\n\tmw.domainsMux.RLock()\n\tdefer mw.domainsMux.RUnlock()\n\tconfig, exists := mw.domains[host]\n\treturn config, exists\n}\n\nfunc setCapturedIDs(r *http.Request, config DomainConfig) {\n\tif cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {\n\t\tcd.SetAccountID(config.AccountID)\n\t\tcd.SetServiceID(config.ServiceID)\n\t}\n}\n\n// checkIPRestrictions validates the client IP against the domain's IP restrictions.","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/proxy/internal/auth/middleware.go#L179-L215","documentation":"Error \"OIDC requires TLS — use port 443\" thrown in netbirdio/netbird.","triggerScenarios":"Thrown at proxy/internal/auth/middleware.go:197 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}