openiddict error invalid_request. This server only accepts HTTPS requests. #10922

12 Answer(s)

• 

  0

  AI-Bot created 6 days ago

  Support Team ABP Agent

  • The ID2083 error means OpenIddict is seeing the incoming request as HTTP, not HTTPS. In a Docker + reverse-proxy setup (TLS terminated at the proxy), this typically happens when the proxy doesn’t forward X-Forwarded-Proto: https (or ASP.NET Core is not allowed to trust/process it early enough).

  • Apply the OpenIddict behind load balancer configuration exactly (note: UseForwardedHeaders() must run before the rest of the pipeline that relies on scheme/host):

  // In your IdpModule (or HttpApiHost module where OpenIddict runs)
  
  public override void ConfigureServices(ServiceConfigurationContext context)
  {
      Configure<ForwardedHeadersOptions>(options =>
      {
          options.ForwardedHeaders =
              ForwardedHeaders.XForwardedFor |
              ForwardedHeaders.XForwardedProto;
      });
  }
  
  public override void OnApplicationInitialization(ApplicationInitializationContext context)
  {
      var app = context.GetApplicationBuilder();
      var env = context.GetEnvironment();
  
      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
      }
  
      // Must be early
      app.UseForwardedHeaders();
  
      // If your proxy cannot forward headers correctly, force https scheme:
      // (put this BEFORE OpenIddict endpoints are hit)
      // app.Use((httpContext, next) =>
      // {
      //     httpContext.Request.Scheme = "https";
      //     return next();
      // });
  
      // ...rest of pipeline
  }
  

  • Reverse proxy requirement: ensure your proxy forwards at least:
    • X-Forwarded-Proto: https
    • X-Forwarded-For: <client-ip>
    • and usually Host

  Once the app correctly sees the request scheme as https, /.well-known/openid-configuration will stop returning invalid_request / ID2083.

  Links (validated):

  • https://abp.io/docs/latest/deployment/forwarded-headers
  • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  marco.susani created 6 days ago

  I already did this steps, but still doesn't work. I'm using traefik as a proxy server and by default it forwards the Proto, For and Host header.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 6 days ago

  Support Team Fullstack Developer

  Hi,

  ForwardedHeadersOptions only trusts loopback proxies by default. Your reverse proxy connects from a Docker network IP, so the X-Forwarded-Proto header is ignored and OpenIddict still sees an HTTP request.

  Please clear the known proxy lists:

  Configure<ForwardedHeadersOptions>(options =>
  {
      options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
      options.KnownIPNetworks.Clear();
      options.KnownProxies.Clear();
  });
  

  Also make sure the proxy sends X-Forwarded-Proto: https. If the app can be reached without going through the proxy, add the proxy IP to KnownProxies instead of clearing the lists.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  marco.susani created 6 days ago

  Ok, i don't have anymore the openid error, but the page https://idp.nicma.com/Account/Login?ReturnUrl=%2Fconnect%2Fauthorize%3Fclient_id%3DIdp_App%26redirect_uri%3Dhttps%253A%252F%252Fidp.nicma.com%26response_type%3Dcode%26scope%3Doffline_access%2520openid%2520profile%2520email%2520phone%2520Idp%26state%3D4719aebbc15b417681ecf6799dfba9ec%26code_challenge%3D2XT5_GBC_lRQf4uBmB7aoeUB-6kACrIXy8AKwOZAwX0%26code_challenge_method%3DS256 go in a loop and continue to redirect it self!

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 6 days ago

  Support Team Fullstack Developer

  Hi,

  Could you share the following so we can see where the loop happens:

  1. The app logs from the time the loop happens, with debug level enabled. See https://abp.io/support/questions/8622/How-to-enable-Debug-logs-for-troubleshoot-problems
  2. The first few redirects from the browser Network tab, with the Location header of each one.
  3. Does the loop start as soon as you open the page, or after you enter the username and password?

  You can also send them to liming.ma@volosoft.com if you don't want to share them here.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  marco.susani created 6 days ago

  Hi,

  i sent all the informations required by mail!

  Thanks a lot.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 6 days ago

  Support Team Fullstack Developer

  Hi,

  Your reverse proxy sends /Account/Login to the React app, not to the ABP app. The React app has its own /account/login page, which starts the login again, so it keeps going /connect/authorize -> /Account/Login -> React -> /connect/authorize.

  The fix depends on how you want to host the apps. Could you share:

  1. Do you want to keep the React app and the ABP app on the same domain, or can the React app use its own domain, for example app.example.com?
  2. Your Traefik config for this domain (routers, rules, priorities and services). Please remove any secrets.
  3. Do you also deploy the public website? If so, on which domain or path?

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  marco.susani created 5 days ago

  Hi,

  i sent all the informations required by mail!

  Thanks a lot.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 4 days ago

  Support Team Fullstack Developer

  Hi,

  I only got the email with the logs and screenshots. They show that /Account/Login returns the React page instead of the ABP login page, so the routing for this domain needs to be fixed.

  Could you share:

  1. Your Traefik version and the Traefik config for idp.example.com (Docker labels or dynamic config files, with the routers, rules, priorities and services). Please remove any secrets.
  2. Do you also deploy the public website? If so, on which domain or path?

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 4 days ago

  Support Team Fullstack Developer

  Hi,

  Your idp-api router uses PathPrefix(`/account`), but Traefik path matching is case-sensitive, so /Account/Login doesn't match it and goes to the React app. Changing it to /Account is not enough either, because the login page also loads files from /libs, /__bundles and /Abp on the backend.

  It's easier to do it the other way around: send everything to the backend by default, and only send the React files and pages to the React app. Please change these labels in your compose file (use your domain) and keep the other labels as they are:

    idp-api:
      labels:
        - "traefik.http.routers.idp-api.rule=Host(`idp.example.com`)"
        - "traefik.http.routers.idp-api.priority=10"
  
    idp-web:
      labels:
        - "traefik.http.routers.idp-web.rule=Host(`idp.example.com`) && (Path(`/`) || Path(`/index.html`) || Path(`/dynamic-env.json`) || Path(`/getEnvConfig`) || Path(`/silent-renew.html`) || Path(`/favicon.png`) || PathPrefix(`/assets/`) || PathRegexp(`^/(identity|403|dynamic)(/|$)`) || Path(`/account`) || Path(`/account/`) || PathRegexp(`^/account/(login|register|forgot-password|reset-password)$`))"
        - "traefik.http.routers.idp-web.priority=100"
  

  dynamic is for the LowCode pages. If you add your own React pages, add their root paths to the PathRegexp list.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  marco.susani created yesterday

  Thanks for the hint, now it works perfectly!

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created yesterday

  Support Team Fullstack Developer

  Great 👍

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel