Problem setting up the angular section of the api #10011

4 Answer(s)

• 

  0

  AI-Bot created 2 days ago

  Support Team ABP Agent

  To resolve the "error validating authorization_endpoint in discovery document" and ensure your ABP Angular application works with your backend in an environment where all internal traffic is HTTP but public endpoints are HTTPS, you must ensure that all URLs in your OpenID Connect discovery document (/.well-known/openid-configuration) use HTTPS. The Angular OAuth2/OIDC client requires all endpoints (issuer, authorization_endpoint, token_endpoint, etc.) to be HTTPS when requireHttps is true (which is the default in production).

  Solution Steps

  1. Kestrel/Reverse Proxy Configuration
     • Even if your app service uses HTTP internally, you must ensure that the URLs generated in the discovery document are HTTPS. This is typically handled by forwarding headers from your reverse proxy (like Azure App Service or Nginx).
     • In your Program.cs or Startup.cs, add the following to enable forwarded headers:

  app.UseForwardedHeaders(new ForwardedHeadersOptions
       {
           ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedFor
       });
  

  • Ensure your reverse proxy (Azure App Service) is configured to forward the X-Forwarded-Proto header.

  2. AppSettings Configuration
     • Set App.SelfUrl to your public HTTPS URL:

  "SelfUrl": "https://dev-configurator-api.mtgcorp.com"
  

  • Set App.AngularUrl to your deployed Angular app's public URL (not localhost for production):

  "AngularUrl": "https://dev-configurator.mtgcorp.com"
  

  • Set App.CorsOrigins to include your Angular app's public URL:

  "CorsOrigins": "https://*.mtgcorp.com"
  

  • Set App.RedirectAllowedUrls to your Angular app's public URL:

  "RedirectAllowedUrls": "https://dev-configurator.mtgcorp.com"
  

  • For local development, you can add http://localhost:4200 to these lists, but for production, only use HTTPS URLs.

  3. RemoteServices Configuration
     • Set RemoteServices.Default.BaseUrl to your backend's public HTTPS URL:

  "RemoteServices": {
         "Default": {
           "BaseUrl": "https://dev-configurator-api.mtgcorp.com/"
         }
       }
  

  • Do the same for any other remote services.

  4. AuthServer Configuration
     • Set AuthServer.Authority to your public HTTPS URL:

  "Authority": "https://dev-configurator-api.mtgcorp.com"
  

  • Set RequireHttpsMetadata to true for production.

  5. Regenerate Discovery Document

     • After making these changes, restart your backend. The discovery document at https://dev-configurator-api.mtgcorp.com/.well-known/openid-configuration should now show all endpoints as HTTPS.

  6. Angular Environment

     • In your Angular environment.prod.ts, set the OAuth config to use the HTTPS backend URL for issuer and endpoints.

  Summary Table

  | Setting | Value (Production) | |---------------------------------|----------------------------------------------------| | App.SelfUrl | https://dev-configurator-api.mtgcorp.com | | App.AngularUrl | https://dev-configurator.mtgcorp.com | | App.CorsOrigins | https://*.mtgcorp.com | | App.RedirectAllowedUrls | https://dev-configurator.mtgcorp.com | | RemoteServices.Default.BaseUrl | https://dev-configurator-api.mtgcorp.com/ | | AuthServer.Authority | https://dev-configurator-api.mtgcorp.com | | AuthServer.RequireHttpsMetadata| true |

  Note: If you need to support local development, add http://localhost:4200 to CORS and RedirectAllowedUrls, but never use HTTP in production.

  References

  • ABP Azure Deployment Configuration
  • Fixing OpenIddict Certificate Issues in IIS or Azure

  This configuration will ensure your discovery document is valid and all endpoints are HTTPS, resolving the Angular OAuth2/OIDC validation error.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  agustinplaza created 2 days ago

  After applying these changes we get the following error: Object { headers: {…}, status: 400, statusText: "Bad Request", url: "https://dev-configurator-api.mtgcorp.com/.well-known/openid-configuration", ok: false, type: undefined, redirected: undefined, name: "HttpErrorResponse", message: "Http failure response for https://dev-configurator-api.mtgcorp.com/.well-known/openid-configuration: 400 Bad Request", error: {…} }

  Save Cancel
• 

  0

  agustinplaza created 2 days ago

  Also, we didn't manage to add app.UseForwardedHeaders(new ForwardedHeadersOptions { ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedFor });, if we add this to Programs it fails compilation.

  Also, trying to access https://dev-configurator-api.mtgcorp.com/.well-known/openid-configuration gives us this:

  error "invalid_request" error_description "This server only accepts HTTPS requests."

  If I fix that using RequireHttpsMetadata=false, we're back to square one with the original error

  Save Cancel
• 

  0

  maliming created 2 days ago

  Support Team Fullstack Developer

  hi

  Can you try to set Request.Scheme to https in your API website?

  
  public override void OnApplicationInitialization(ApplicationInitializationContext context)
  {
      var env = context.GetEnvironment();
      var app = context.GetApplicationBuilder();
  
      app.Use(async (ctx, next) =>
      {
          ctx.Request.Scheme = "https";
          await next();
      });     
      
      //...
  

  Thanks.

  Save Cancel