redirect_uri_mismatch when trying to login using google oauth

Description:

Using the kubernetes helm chart for rocketchat, when trying to log in using google, I get the following error in the backend.

"line":"403","file":"oauth_server.js","message":"Error in OAuth Server: Failed to co
mplete OAuth handshake with Google. failed [400] {   \"error\": \"redirect_uri_mismat
ch\",   \"error_description\": \"Bad Request\" }","time":{"$date":1608018483381},"lev
el":"warn"}
Exception while invoking method 'login' Error: Failed to complete OAuth handshake wit
h Google. failed [400] {   "error": "redirect_uri_mismatch",   "error_description": "
Bad Request" }
    at getTokens (packages/google-oauth/google_server.js:105:7)
    at Object.getServiceData [as handleOauthRequest] (packages/google-oauth/google_se
rver.js:80:58)

Steps to reproduce:

1. Install the helm chart using the following extraEnvs:

extraEnv: |
  - name: ROOT_URL
    value: "https://<domain>"
  - name: OVERWRITE_SETTING_Accounts_OAuth_Google
      value: "true"
  - name: OVERWRITE_SETTING_Accounts_OAuth_Google_id
    value: "<google_id>"
  - name: OVERWRITE_SETTING_Accounts_OAuth_Google_secret
    value: "<secret>"

2. Log in using the google oauth button

Expected behavior:

User logs in successfully

Actual behavior:

A notification with Internal Server Error pops up. Pod logs show the ff:

{"line":"403","file":"oauth_server.js","message":"Error in OAuth Server: Failed to co
mplete OAuth handshake with Google. failed [400] {   \"error\": \"redirect_uri_mismat
ch\",   \"error_description\": \"Bad Request\" }","time":{"$date":1608018483381},"lev
el":"warn"}
Exception while invoking method 'login' Error: Failed to complete OAuth handshake wit
h Google. failed [400] {   "error": "redirect_uri_mismatch",   "error_description": "
Bad Request" }
    at getTokens (packages/google-oauth/google_server.js:105:7)
    at Object.getServiceData [as handleOauthRequest] (packages/google-oauth/google_se
rver.js:80:58)
    at OAuth._requestHandlers.<computed> (packages/oauth2/oauth2_server.js:10:33)
    at middleware (packages/oauth/oauth_server.js:170:5)
    at /app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteo
r-promise/fiber_pool.js:43:40

Server Setup Information:

• Version of Rocket.Chat Server: 3.6.0
• Operating System: Alpine
• Deployment Method: k8s
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.16.1 - x64
• MongoDB Version: 3.6.8-2.0

Client Setup Information

• Desktop App or Browser Version: Chrome 87.0.4280.66
• Operating System: Ubuntu 16.04

Additional context

Confirmed that the value of Meteor.absoluteUrl() is correct from the developer tools.

Meteor.absoluteUrl()
"https://chat.k.tools-stg.flnltd.com/"

and that both https://chat.k.tools-stg.flnltd.com/_oauth/google and https://chat.k.tools-stg.flnltd.com/_oauth/google?close are in the allowed redirect uris of the google app.

Relevant logs:

Browser:
"isClientSafe":true,"error":500,"reason":"Internal server error","message":"Internal server error [500]","errorType":"Meteor.Error"}

Server:

{"line":"403","file":"oauth_server.js","message":"Error in OAuth Server: Failed to co
mplete OAuth handshake with Google. failed [400] {   \"error\": \"redirect_uri_mismat
ch\",   \"error_description\": \"Bad Request\" }","time":{"$date":1608018483381},"lev
el":"warn"}
Exception while invoking method 'login' Error: Failed to complete OAuth handshake wit
h Google. failed [400] {   "error": "redirect_uri_mismatch",   "error_description": "
Bad Request" }
    at getTokens (packages/google-oauth/google_server.js:105:7)
    at Object.getServiceData [as handleOauthRequest] (packages/google-oauth/google_se
rver.js:80:58)
    at OAuth._requestHandlers.<computed> (packages/oauth2/oauth2_server.js:10:33)
    at middleware (packages/oauth/oauth_server.js:170:5)
    at /app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteo
r-promise/fiber_pool.js:43:40

Start with packages/google-oauth/google_server.js, especially getServiceData and getTokens at the stack-trace locations, and trace the redirect URI used during the Google OAuth handshake. Compare that value with the Helm chart's ROOT_URL and configured Google allowed redirect URIs. Done means the reported Kubernetes deployment completes Google login without redirect_uri_mismatch.