siyuan-note/siyuan · error
OIDC issuer URL must use HTTPS unless it is a loopback addre
Error message
OIDC issuer URL must use HTTPS unless it is a loopback address
What it means
Fifth check in ValidateOIDCConfiguration (kernel/model/oidc.go:528): for Custom/Microsoft providers the parsed IssuerURL must have a host, no userinfo/query/fragment, and a scheme that is either 'https' or, if not https, a hostname that resolves to loopback via util.IsLocalHostname. Any deviation returns this error.
Source
Thrown at kernel/model/oidc.go:528
func ValidateOIDCConfiguration(config *conf.OIDC) error {
if config == nil || !config.Enabled {
return errors.New("OIDC login is not enabled")
}
if config.ClientID == "" {
return errors.New("OIDC client ID is required")
}
if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
return errors.New("GitHub OAuth client secret is required")
}
if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
return errors.New("OIDC issuer URL is required")
}
if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
issuer, err := url.Parse(config.IssuerURL)
if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
}
}
if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
return errors.New("Unsupported OIDC provider")
}
if !config.AllowAll && len(config.ClaimRules) == 0 {
return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
}
for _, rule := range config.ClaimRules {
if rule == nil || rule.Claim == "" || len(rule.Values) == 0 {
return errors.New("OIDC claim rules must include a claim and at least one value")
}
if rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {
return errors.New("Unsupported OIDC claim rule operator")
}
for _, value := range rule.Values {
if value == "" {View on GitHub (pinned to 251596fc0d)
Solutions
- Switch the issuer to HTTPS (terminate TLS at the IdP or a reverse proxy).
- If you must use HTTP, run the IdP on localhost/127.0.0.1 so IsLocalHostname returns true.
- Strip any query, fragment, or userinfo from the URL before saving; keep only scheme://host[:port]/path.
Example fix
// before cfg.IssuerURL = "http://keycloak.corp:8080/auth/realms/demo" // after — TLS-terminate or use loopback cfg.IssuerURL = "https://keycloak.corp/auth/realms/demo" // or local dev only cfg.IssuerURL = "http://localhost:8080/auth/realms/demo"
Defensive patterns
Strategy: validation
Validate before calling
u, err := url.Parse(cfg.IssuerURL)
if err != nil || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
return errors.New("issuer URL malformed")
}
if u.Scheme != "https" && !util.IsLocalHostname(u.Hostname()) {
return errors.New("issuer must be HTTPS or loopback")
} Type guard
func issuerURLSafe(raw string) bool {
u, err := url.Parse(raw)
if err != nil || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
return false
}
return u.Scheme == "https" || util.IsLocalHostname(u.Hostname())
} Prevention
- Always TLS-terminate OIDC issuers in production; reserve HTTP for true loopback dev.
- Validate the URL client-side before saving the config to avoid round-tripping.
When it happens
Trigger: Saving an issuer URL like http://keycloak.example.com (non-HTTPS public host), http://localhost:8080 with userinfo, a URL with a trailing query (?foo=bar), or a URL that fails to parse.
Common situations: Local dev pointing at a plain-HTTP Keycloak on a non-loopback hostname; copy-pasting a discovery URL with the .well-known suffix or a query string; using 'http://' against a public test IdP.
Related errors
- Public OIDC redirect URL must use HTTPS
- OIDC issuer URL is required
- OIDC login requires at least one claim rule when Allow all u
- remote access requires at least one authentication method
- Desktop OIDC login requires a loopback listener
AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12).
Data as JSON: /api/errors/f4e5ce3ed5cbb414.
Report an issue: GitHub.