Set redirect_uri schema when using Github authentication in app running in docker behind load balancer

[marcuslindblom]

When my app runs this code

var redirectUrl = Url.Action("GithubCallback", "Auth", new { ReturnUrl = returnUrl });
var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);

return Challenge(properties, provider);

the redirect_uri is http and not https.

I have this configuration in place:

services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.244.0.0"), 16));
});

How can I configure the scheme to use when Challenge is called?

[Tratcher]

Sounds like your forwarders aren't working right. See this guide: https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1#troubleshoot

Once you get that fixed then the generated urls should be right.

[marcuslindblom]

@Tratcher You seem to be correct. I use AKS and this is what I see in the Azure portal: Pod CIDR 10.244.0.0/16. This is how I have configured the know networks in my app

      services.Configure<ForwardedHeadersOptions>(options =>
      {
        options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
        options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.244.0.0"), 16));
      });

and this is what I see in the log

X-Request-ID: ba108fb986a51c14b7015abf3373a545
X-Real-IP: 10.244.1.1
X-Original-Proto: http
X-Forwarded-Host: xxx.app
X-Forwarded-Port: 80
X-Scheme: http
X-Original-Forwarded-For: 109.228.158.219
CF-IPCountry: SE
CF-RAY: 5c516f014d6d15e8-ARN
CF-Visitor: {"scheme":"https"}
sec-fetch-site: same-origin
sec-fetch-mode: same-origin
sec-fetch-dest: empty
CF-Request-ID: 04a6c3b4ca000015e83ebc1200000001
CF-Connecting-IP: 109.228.158.219
CDN-Loop: cloudflare
X-Original-For: [::ffff:10.244.1.241]:45874

Request RemoteIp: 10.244.1.1

app.UseForwardedHeaders(); is added at the top of Configure.

I have two pods and the other pod uses IP: 10.240.0.5.

Any idea whats wrong here?

[Tratcher]

Looks like TLS is terminating at cloudflare and they're adding a special CF-Visitor header. That's not a format I recognize, you may have to check for it manually.

There's always these workarounds:
https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1#when-it-isnt-possible-to-add-forwarded-headers-and-all-requests-are-secure

[marcuslindblom]

@Tratcher What do you mean by checking for it manually?

The workaround you posted does not make any difference in the output.

X-Request-ID: 6440d8cc2c8f1ea73906b1d52ab82180
X-Real-IP: 10.240.0.4
X-Original-Proto: http
X-Forwarded-Host: xxx.app
X-Forwarded-Port: 80
X-Scheme: http
X-Original-Forwarded-For: 212.247.94.65
CF-IPCountry: SE
CF-RAY: 5c51be8169f3d885-CPH
CF-Visitor: {"scheme":"https"}
sec-fetch-site: same-origin
sec-fetch-mode: same-origin
sec-fetch-dest: empty
CF-Request-ID: 04a6f564dc0000d8852a272200000001
CF-Connecting-IP: 212.247.94.65
CDN-Loop: cloudflare
X-Original-For: [::ffff:10.244.1.241]:53800

Request RemoteIp: 10.240.0.4

[Tratcher]

Add httpContext.Request.Scheme to the output, that's the final field you're worried about.