HangfireIO / HangfireIO/Hangfire

Hangfire UI - redirect_uri is http instead of https

Open
#2,402 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
10.1k
Forks
1.8k
Avg merge
1h 19m
Merged PRs (30d)
1

Description

Hi,
I would like to enable HF UI in my application.

I am using auth0. The problem is when I try to log in in auth0 I am redirected to such a page:
```
Callback URL mismatch.
The provided redirect_uri is not in the list of allowed callback URLs.
Please go to the [Application Settings page] and make sure you are sending a valid callback url from your application.
```

This is aligned with auth0 configuration I have and this is expected behavior because the redirect_uri is http instead of https:
```
&redirect_uri=http%3A%2F%2Fapi-
```
I allow only https urls.

Here is my configuration:
```
public class Startup
{
//...

public void Configure(IApplicationBuilder app, IHostEnvironment env)
{
//...
app.UseHttpsRedirection();
//...
app.UseEndpoints(endpoints =>
{
//...

AddHangfireDashboardIfConfigured(app, endpoints);
});
}

private void AddHangfireDashboardIfConfigured(IApplicationBuilder app, IEndpointRouteBuilder endpoints)
{
var configuration = app.ApplicationServices.GetService();
if (configuration != null)
{
endpoints.MapHangfireDashboard(HangfireAuthenticationOptions.HangfireDashboardUrl, new DashboardOptions
{
IsReadOnlyFunc = _ =>
{
var authenticationOptions = _configuration
.GetSection(HangfireAuthenticationOptions.Authentication)
.Get() ?? new HangfireAuthenticationOptions();

return authenticationOptions.IsReadonly;
},
}).RequireAuthorization(ApplicationAuthorizationServiceCollectionExtensions.HangfireAuthorizationPolicyName);
}
}
}
```

Is there any way to force Hangfire UI to use https instead of http?

Contributor guide

Open the contributing guide

Research direction

Start at the Configure method and the MapHangfireDashboard call, then reproduce the Auth0 login flow with UseHttpsRedirection enabled. Trace how the callback redirect URI is formed and verify the application receives the HTTPS scheme. Done means the generated redirect_uri uses https and the Auth0 callback succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.