LINE authentication issue occurring in nginx https,

[ahjszll]

The site is deployed after nginx https, and the callback uri for LINE validation uses https，https://{ip}//signin-line

Nginx proxy to http://127.0.0.1:5000

The following code seems to have an issue

src/AspNet.Security.OAuth.Line/LineAuthenticationHandler.cs

 protected override async Task<OAuthTokenResponse> ExchangeCodeAsync([NotNull] OAuthCodeExchangeContext context)
    {
        var tokenRequestParameters = new Dictionary<string, string>
        {
            ["grant_type"] = "authorization_code",
            ["code"] = context.Code,
            ["redirect_uri"] = context.RedirectUri,
            ["client_id"] = Options.ClientId,
            ["client_secret"] = Options.ClientSecret,
        };

      ...
    }

Its uses HTTP instead of HTTPS ["redirect_uri"] = context.RedirectUri

Should be transmitted
https://{ip}//signin-line

But actually
http://{ip}//signin-line

Perhaps we can specify in the options whether HTTPS is enabled or not

[martincostello]

It's highly likely that your server isn't configured correctly to trust X-Forwarded-* headers, which means that ASP.NET Core can't "see" that it's an HTTPS request, which causes the wrong scheme to be used to build the redirect URL.

See https://learn.microsoft.com/aspnet/core/host-and-deploy/linux-nginx for further details on how to configure this.

[ahjszll]

Actually,I have already set it correctly: application.UseForwardedHeaders

   if (hostingConfig.UseProxy)
   {
       var options = new ForwardedHeadersOptions
       {
           ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto,
           // IIS already serves as a reverse proxy and will add X-Forwarded headers to all requests,
           // so we need to increase this limit, otherwise, passed forwarding headers will be ignored.
           ForwardLimit = 2
       };
       application.UseForwardedHeaders(options);
   }

I will double check later

But,There is something suspicious,
src/AspNet.Security.OAuth.Line/LineAuthenticationHandler.cs

protected override string BuildChallengeUrl([NotNull] AuthenticationProperties properties, [NotNull] string redirectUri)
  {
      var challengeUrl = base.BuildChallengeUrl(properties, redirectUri);
      return QueryHelpers.AddQueryString(challengeUrl, "prompt", Options.Prompt ? "consent" : string.Empty);
  }

This redirectUri is the correct address and contains https, so my UseForwardedHeaders are effective

[martincostello]

It may be that your application doesn't trust the headers from an upstream proxy, so is ignoring them.
There's information about that here (the content about KnownProxies and KnownNetworks).