siyuan-note/siyuan · error

Public OIDC redirect URL must use HTTPS

Error message

Public OIDC redirect URL must use HTTPS

What it means

The redirect URL has the correct path but its scheme is not https (typically http). For remote/public access the kernel mandates TLS so the authorization code is never transported over plaintext, even if TLS is terminated upstream.

Source

Thrown at kernel/model/oidc.go:638

		return oidcMobileRedirectURL, nil
	}
	if config.RedirectURL != "" {
		return validatePublicOIDCRedirectURL(config.RedirectURL)
	}
	return effectiveOIDCRedirectURL(c, oidcFlowDesktop)
}

func validatePublicOIDCRedirectURL(redirectURL string) (string, error) {
	if redirectURL == "" {
		return "", errors.New("A public HTTPS OIDC redirect URL is required for remote access")
	}
	parsed, err := url.Parse(redirectURL)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" || parsed.Path != "/api/system/oidc/callback" ||
		parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
		return "", errors.New("OIDC redirect URL must end with /api/system/oidc/callback")
	}
	if parsed.Scheme != "https" {
		return "", errors.New("Public OIDC redirect URL must use HTTPS")
	}
	return parsed.String(), nil
}

func getOIDCProvider(ctx context.Context, redirectURL string) (*oidc_provider.Provider, error) {
	version := oidcConfigurationVersion(Conf.GetOIDC())
	key := version + "\x00" + redirectURL
	oidcProviders.Lock()
	if oidcProviders.version != version {
		oidcProviders.version = version
		oidcProviders.items = map[string]*oidc_provider.Provider{}
	}
	if provider := oidcProviders.items[key]; provider != nil {
		oidcProviders.Unlock()
		return provider, nil
	}
	oidcProviders.Unlock()
	discoveryContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)

View on GitHub (pinned to 251596fc0d)

Solutions

  1. Change the redirect URL scheme to https.
  2. Put SiYuan behind a TLS-terminating reverse proxy and use the https URL.
  3. For pure local testing, access SiYuan via loopback so the public-URL path is not taken.

Example fix

// before
RedirectURL: "http://notes.example.com/api/system/oidc/callback"
// after
RedirectURL: "https://notes.example.com/api/system/oidc/callback"
Defensive patterns

Strategy: validation

Validate before calling

// Require https for any public redirect URL before persisting it.
if u, err := url.Parse(redirectURL); err == nil && u.Scheme != "https" && isPublicHost(u.Host) {
    return errors.New("public OIDC redirect URL must use HTTPS")
}

Prevention

When it happens

Trigger: validatePublicOIDCRedirectURL receives a URL like http://notes.example.com/api/system/oidc/callback while the request is non-local.

Common situations: Operator configures the http form by mistake behind a TLS-terminating proxy; a local-only http setup was later exposed remotely.

Related errors


AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/40d185bb4cb12da1. Report an issue: GitHub.