netbirdio/netbird · error

OIDC requires TLS — use port 443

Error message

OIDC requires TLS — use port 443

What it means

Error "OIDC requires TLS — use port 443" thrown in netbirdio/netbird.

Source

Thrown at proxy/internal/auth/middleware.go:197

	return false
}

// blockOIDCOnPlainHTTP fails fast when an OIDC-configured domain is hit
// over plain HTTP. Most IdPs reject http:// redirect URIs, so surfacing
// the misconfiguration here yields a clearer error than the IdP's
// "invalid redirect_uri" round-trip.
func (mw *Middleware) blockOIDCOnPlainHTTP(w http.ResponseWriter, r *http.Request, config DomainConfig) bool {
	if !requestIsPlainHTTP(r) {
		return false
	}
	if !hasOIDCScheme(config.Schemes) {
		return false
	}
	mw.logger.WithFields(log.Fields{
		"host":   r.Host,
		"remote": r.RemoteAddr,
	}).Warn("OIDC scheme reached on plain HTTP path; rejecting with 400 — use port 443")
	http.Error(w, "OIDC requires TLS — use port 443", http.StatusBadRequest)
	return true
}

func (mw *Middleware) getDomainConfig(host string) (DomainConfig, bool) {
	mw.domainsMux.RLock()
	defer mw.domainsMux.RUnlock()
	config, exists := mw.domains[host]
	return config, exists
}

func setCapturedIDs(r *http.Request, config DomainConfig) {
	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
		cd.SetAccountID(config.AccountID)
		cd.SetServiceID(config.ServiceID)
	}
}

// checkIPRestrictions validates the client IP against the domain's IP restrictions.

View on GitHub (pinned to 93e97f4bf1)

When it happens

Trigger: Thrown at proxy/internal/auth/middleware.go:197 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/53059c08c41c039e. Report an issue: GitHub.