"Error retrieving discovery document: Endpoint does not use HTTPS: http://authserver.mydomain.dev/connect/authorize", #9849

18 Answer(s)

• 

  0

  AI-Bot created 21 days ago

  Support Team ABP Agent

  Your issue is caused by the OpenID Connect discovery document returning HTTP endpoints (e.g., "authorization_endpoint": "http://authserver.mydomain.dev/connect/authorize") instead of HTTPS, while your clients and security libraries require all endpoints to use HTTPS.

  This typically happens when your AuthServer is running behind a reverse proxy (like ingress-nginx in AKS), and the application itself is listening on HTTP. OpenIddict (or IdentityServer) generates endpoint URLs based on the incoming request's scheme, which is HTTP unless you explicitly handle forwarded headers.

  Solution:

  1. Forwarded Headers Middleware

     In your AuthServer's Startup or module initialization, add the following before any authentication middleware:

  app.UseForwardedHeaders(new ForwardedHeadersOptions
     {
         ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedFor,
         // Optionally, set KnownProxies or KnownNetworks if needed for security
     });
  

  This ensures the app recognizes the original HTTPS scheme from the proxy.

  2. Force HTTPS Scheme (if needed)

     If the above does not resolve the issue, you can force the request scheme to HTTPS as a workaround:

  app.Use(async (ctx, next) =>
     {
         ctx.Request.Scheme = "https";
         await next();
     });
  

  Place this middleware before authentication and OpenIddict middlewares.

  3. Set OpenIddict Issuer Explicitly

     In your AuthServer module, ensure you set the issuer to your public HTTPS URL:

  PreConfigure<OpenIddictServerBuilder>(builder =>
     {
         builder.SetIssuer(new Uri(configuration["AuthServer:Authority"]!));
     });
  

  4. Check NGINX/Ingress Configuration

     Make sure your ingress-nginx is forwarding the X-Forwarded-Proto header and not stripping it.

  5. Restart and Test

     After making these changes, restart your AuthServer pod and check the discovery document at https://authserver.mydomain.dev/.well-known/openid-configuration. All endpoints should now use HTTPS.

  References:

  • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment
  • https://abp.io/support/questions/9359

  This approach is the recommended and secure way to ensure your OpenIddict endpoints are correctly exposed as HTTPS behind a reverse proxy in Kubernetes.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  rogercprops created 20 days ago

  The above changes didn't solve the problem

  Save Cancel
• 

  0

  rogercprops created 20 days ago

  Updated authserver initialization

  public override void OnApplicationInitialization(ApplicationInitializationContext context)
      {
          var app = context.GetApplicationBuilder();
          var env = context.GetEnvironment();
          var configuration = context.ServiceProvider.GetRequiredService<IConfiguration>();
  
          app.UseForwardedHeaders(new ForwardedHeadersOptions
          {
              ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedFor,
              // Optionally, set KnownProxies or KnownNetworks if needed for security
          });
  
          app.Use(async (context, next) =>
          {
              context.Request.Scheme = "https";
              await next();
          });
  

  Updated ingress

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: "{{ .Release.Name }}-{{ .Chart.Name }}"
    annotations:
      nginx.ingress.kubernetes.io/rewrite-target: "/"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "32k"
      nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
      nginx.ingress.kubernetes.io/enable-real-ip: "true"
      nginx.ingress.kubernetes.io/proxy-real-ip-cidr: "0.0.0.0/0"
      cert-manager.io/cluster-issuer: "letsencrypt"
  

  Save Cancel
• 

  0

  rogercprops created 20 days ago

  Don't know what I did but just redeployed and it worked

  Save Cancel
• 

  0

  rogercprops created 14 days ago

  I have no idea what has changed but it's giving the Error retrieving discovery document: Endpoint does not use HTTPS: http://authserver.mydomain.dev/connect/authorize.

  It was working yesterday and now it's not.

  Save Cancel
• 

  0

  maliming created 14 days ago

  Support Team Fullstack Developer

  hi

  What is the code of the DiscoveryCache class?

  It throws the Endpoint does not use HTTPS: http://authserver.mydomain.dev/connect/authorize

  Thanks.

  Save Cancel
• 

  0

  rogercprops created 14 days ago

  DiscoveryCache is from the Duende.IdentityModel package

  // Copyright (c) Duende Software. All rights reserved.
  // Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
  
  using Duende.IdentityModel.Internal;
  
  namespace Duende.IdentityModel.Client;
  
  /// <summary>
  /// Helper for caching discovery documents.
  /// </summary>
  public class DiscoveryCache : IDiscoveryCache
  {
      private DateTime _nextReload = DateTime.MinValue;
      private AsyncLazy<DiscoveryDocumentResponse>? _lazyResponse;
  
      private readonly DiscoveryPolicy _policy;
      private readonly Func<HttpMessageInvoker> _getHttpClient;
      private readonly string _authority;
  
      /// <summary>
      /// Initialize instance of DiscoveryCache with passed authority.
      /// </summary>
      /// <param name="authority">Base address or discovery document endpoint.</param>
      /// <param name="policy">The policy.</param>
      public DiscoveryCache(string authority, DiscoveryPolicy? policy = null)
      {
          _authority = authority;
          _policy = policy ?? new DiscoveryPolicy();
          _getHttpClient = () => new HttpClient();
      }
  
      /// <summary>
      /// Initialize instance of DiscoveryCache with passed authority.
      /// </summary>
      /// <param name="authority">Base address or discovery document endpoint.</param>
      /// <param name="httpClientFunc">The HTTP client function.</param>
      /// <param name="policy">The policy.</param>
      public DiscoveryCache(string authority, Func<HttpMessageInvoker> httpClientFunc, DiscoveryPolicy? policy = null)
      {
          _authority = authority;
          _policy = policy ?? new DiscoveryPolicy();
          _getHttpClient = httpClientFunc ?? throw new ArgumentNullException(nameof(httpClientFunc));
      }
  
      /// <summary>
      /// Frequency to refresh discovery document. Defaults to 24 hours.
      /// </summary>
      public TimeSpan CacheDuration { get; set; } = TimeSpan.FromHours(24);
  
      /// <summary>
      /// Get the DiscoveryResponse either from cache or from discovery endpoint.
      /// </summary>
      /// <returns></returns>
      public Task<DiscoveryDocumentResponse> GetAsync()
      {
          if (_nextReload <= DateTime.UtcNow)
          {
              Refresh();
          }
  
          return _lazyResponse!.Value;
      }
  
      /// <summary>
      /// Marks the discovery document as stale and will trigger a request to the discovery endpoint on the next request to get the DiscoveryResponse.
      /// </summary>
      public void Refresh()
      {
          _lazyResponse = new AsyncLazy<DiscoveryDocumentResponse>(GetResponseAsync);
      }
  
      private async Task<DiscoveryDocumentResponse> GetResponseAsync()
      {
          var result = await _getHttpClient().GetDiscoveryDocumentAsync(new DiscoveryDocumentRequest
          {
              Address = _authority,
              Policy = _policy
          }).ConfigureAwait();
  
          if (result.IsError)
          {
              Refresh();
              _nextReload = DateTime.MinValue;
          }
          else
          {
              _nextReload = DateTime.UtcNow.Add(CacheDuration);
          }
  
          return result;
      }
  }
  

  Save Cancel
• 

  0

  maliming created 14 days ago

  Support Team Fullstack Developer

  hi

  Set RequireHttps of DiscoveryPolicy to false

  DiscoveryPolicy

  var policy = new DiscoveryPolicy
  {
      RequireHttps = false
  };
  

  Save Cancel
• 

  0

  rogercprops created 14 days ago

  Set it where?

  Save Cancel
• 

  0

  maliming created 13 days ago

  Support Team Fullstack Developer

  hi

  Set is as your _policy default value or pass it as a parameter.

  

  Save Cancel
• 

  0

  rogercprops created 8 days ago

  This answer still doesn't make sense. We have not touched the Token service since 8/27. But I just made a change to the authserver and redeployed. It's now working again (not throwing a http error and successfully returning a token).

  So something else must be happening.

  Save Cancel
• 

  0

  maliming created 8 days ago

  Support Team Fullstack Developer

  hi

  It could be that there are minor changes in your server environment or code. Errors don't just appear out of nowhere.

  Thanks.

  Save Cancel
• 

  0

  rogercprops created 6 days ago

  I made the change to the token service passing var policy = new DiscoveryPolicy

  {
      RequireHttps = false
  };
  
  

  and am now getting this error

  {
      "error": {
          "code": null,
          "message": "Error retrieving discovery document: Invalid base address for endpoint http://authserver.mydomain.dev/connect/authorize. Valid base addresses: https://authserver.mydomain.dev.",
          "details": null,
          "data": {},
          "validationErrors": null
      }
  }
  

  Save Cancel
• 

  0

  maliming created 6 days ago

  Support Team Fullstack Developer

  hi

  Can you share your code?

  This is not abp code, but IdentityModel

  Thanks.

  Error retrieving discovery document: Invalid base address for endpoint 
  
  http://authserver.mydomain.dev/connect/authorize. 
  
  Valid base addresses: https://authserver.mydomain.dev.
  

  Save Cancel
• 

  0

  rogercprops created 5 days ago

  I just granted you access to the Token service and auth-server GitHub repositories

  Save Cancel
• 

  0

  maliming created 5 days ago

  Support Team Fullstack Developer

  hi

  

  Save Cancel
• 

  0

  rogercprops created 4 days ago

  I think this fixed it.

  Thank you.

  Save Cancel
• 

  0

  maliming created 4 days ago

  Support Team Fullstack Developer

  Great : )

  Save Cancel