siyuan-note/siyuan · error
Public OIDC redirect URL must use HTTPS
Error message
Public OIDC redirect URL must use HTTPS
What it means
The redirect URL has the correct path but its scheme is not https (typically http). For remote/public access the kernel mandates TLS so the authorization code is never transported over plaintext, even if TLS is terminated upstream.
Source
Thrown at kernel/model/oidc.go:638
return oidcMobileRedirectURL, nil
}
if config.RedirectURL != "" {
return validatePublicOIDCRedirectURL(config.RedirectURL)
}
return effectiveOIDCRedirectURL(c, oidcFlowDesktop)
}
func validatePublicOIDCRedirectURL(redirectURL string) (string, error) {
if redirectURL == "" {
return "", errors.New("A public HTTPS OIDC redirect URL is required for remote access")
}
parsed, err := url.Parse(redirectURL)
if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.Path != "/api/system/oidc/callback" ||
parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
return "", errors.New("OIDC redirect URL must end with /api/system/oidc/callback")
}
if parsed.Scheme != "https" {
return "", errors.New("Public OIDC redirect URL must use HTTPS")
}
return parsed.String(), nil
}
func getOIDCProvider(ctx context.Context, redirectURL string) (*oidc_provider.Provider, error) {
version := oidcConfigurationVersion(Conf.GetOIDC())
key := version + "\x00" + redirectURL
oidcProviders.Lock()
if oidcProviders.version != version {
oidcProviders.version = version
oidcProviders.items = map[string]*oidc_provider.Provider{}
}
if provider := oidcProviders.items[key]; provider != nil {
oidcProviders.Unlock()
return provider, nil
}
oidcProviders.Unlock()
discoveryContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)View on GitHub (pinned to 251596fc0d)
Solutions
- Change the redirect URL scheme to https.
- Put SiYuan behind a TLS-terminating reverse proxy and use the https URL.
- For pure local testing, access SiYuan via loopback so the public-URL path is not taken.
Example fix
// before RedirectURL: "http://notes.example.com/api/system/oidc/callback" // after RedirectURL: "https://notes.example.com/api/system/oidc/callback"
Defensive patterns
Strategy: validation
Validate before calling
// Require https for any public redirect URL before persisting it.
if u, err := url.Parse(redirectURL); err == nil && u.Scheme != "https" && isPublicHost(u.Host) {
return errors.New("public OIDC redirect URL must use HTTPS")
} Prevention
- Terminate TLS at the reverse proxy and configure the https URL even if SiYuan itself serves http.
- Reserve http URLs for loopback-only local testing.
- Validate via the admin UI's validate flow after changing scheme.
When it happens
Trigger: validatePublicOIDCRedirectURL receives a URL like http://notes.example.com/api/system/oidc/callback while the request is non-local.
Common situations: Operator configures the http form by mistake behind a TLS-terminating proxy; a local-only http setup was later exposed remotely.
Related errors
- A public HTTPS OIDC redirect URL is required for remote acce
- OIDC issuer URL must use HTTPS unless it is a loopback addre
- OIDC redirect URL must end with /api/system/oidc/callback
- [%s] is not sub path of workspace
- OIDC login requires at least one claim rule when Allow all u
AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12).
Data as JSON: /api/errors/40d185bb4cb12da1.
Report an issue: GitHub.