starred/pocket-id-pocket-id-2
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 22:52:58 +03:00
Code Issues 116 Packages Projects Releases 10 Wiki Activity

🐛 Bug Report: invalid callback URL #458

New Issue
Closed
opened 2025-10-09 16:47:56 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2025-10-09 16:47:56 +03:00
Owner
Copy Link

Originally created by @hametovbr on GitHub.

Reproduction steps

When I try to use pocket-id with oauth2-proxy I am able to login using pocket-id to oauth2-proxy itself, but when I try to login to another server on my network I get "Invalid callback URL".
Reverse-proxy: traefik
Callback URL : https://<oauth-proxy-url>/oauth2/callback
Service labels:

    labels:
      - traefik.enable=true
      - traefik.http.routers.paperless.rule=Host(`<service>`)
      - traefik.http.routers.paperless.entrypoints=websecure
      - traefik.http.middlewares.oauth2.forwardauth.address=https://<oauth-proxy>
      - traefik.http.middlewares.oauth2.forwardauth.authResponseHeaders=X-Auth-Request-User,X-Auth-Request-Email
      - traefik.http.routers.paperless.middlewares=oauth2

Pocket-Id logs:

2024-11-15T21:54:41.687980354Z [GIN] 2024/11/15 - 21:54:41 | 400 |    1.059384ms |      172.18.0.1 | POST     "/api/oidc/authorize/new-client"
2024-11-15T21:54:41.687988526Z Error #01: invalid callback URL

OAuth2-Proxy config (env):

      OAUTH2_PROXY_PROVIDER: oidc
      OAUTH2_PROXY_OIDC_ISSUER_URL: <pocket-id>
      OAUTH2_PROXY_CLIENT_ID: <client-id>
      OAUTH2_PROXY_CLIENT_SECRET: <client-secret>
      OAUTH2_PROXY_COOKIE_SECRET: <cookie-secret>
      OAUTH2_PROXY_COOKIE_SECURE: true
      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
      OAUTH2_PROXY_REVERSE_PROXY: true
      OAUTH2_PROXY_SCOPE: "openid email profile groups"
      OAUTH2_PROXY_EMAIL_DOMAINS: "*" 
      OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: true
      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: true
      OAUTH2_PROXY_WHITELIST_DOMAINS: "*.<my-domain>"

Expected behavior

Successfully redirect back to service.

Actual Behavior

I get an "invalid callback URL" error.

Originally created by @hametovbr on GitHub. ### Reproduction steps When I try to use pocket-id with oauth2-proxy I am able to login using pocket-id to oauth2-proxy itself, but when I try to login to another server on my network I get "Invalid callback URL". Reverse-proxy: `traefik` Callback URL : `https://<oauth-proxy-url>/oauth2/callback` Service labels: ``` labels: - traefik.enable=true - traefik.http.routers.paperless.rule=Host(`<service>`) - traefik.http.routers.paperless.entrypoints=websecure - traefik.http.middlewares.oauth2.forwardauth.address=https://<oauth-proxy> - traefik.http.middlewares.oauth2.forwardauth.authResponseHeaders=X-Auth-Request-User,X-Auth-Request-Email - traefik.http.routers.paperless.middlewares=oauth2 ``` Pocket-Id logs: ``` 2024-11-15T21:54:41.687980354Z [GIN] 2024/11/15 - 21:54:41 | 400 | 1.059384ms | 172.18.0.1 | POST "/api/oidc/authorize/new-client" 2024-11-15T21:54:41.687988526Z Error #01: invalid callback URL ``` OAuth2-Proxy config (env): ``` OAUTH2_PROXY_PROVIDER: oidc OAUTH2_PROXY_OIDC_ISSUER_URL: <pocket-id> OAUTH2_PROXY_CLIENT_ID: <client-id> OAUTH2_PROXY_CLIENT_SECRET: <client-secret> OAUTH2_PROXY_COOKIE_SECRET: <cookie-secret> OAUTH2_PROXY_COOKIE_SECURE: true OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180 OAUTH2_PROXY_REVERSE_PROXY: true OAUTH2_PROXY_SCOPE: "openid email profile groups" OAUTH2_PROXY_EMAIL_DOMAINS: "*" OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: true OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: true OAUTH2_PROXY_WHITELIST_DOMAINS: "*.<my-domain>" ``` ### Expected behavior Successfully redirect back to service. ### Actual Behavior I get an "invalid callback URL" error.
OVERLORD added the bug label 2025-10-09 16:47:56 +03:00
OVERLORD commented 2025-10-09 16:48:00 +03:00
Author
Owner
Copy Link

@hametovbr commented on GitHub:

Lol, as expected - my bad, missed in oauth2-proxy

OAUTH2_PROXY_REDIRECT_URL: https://oauth2.<mydomain>/oauth2/callback

Keeping for future fellow selfhosters - do not be as silly as me.

@hametovbr commented on GitHub: Lol, as expected - my bad, missed in oauth2-proxy ``` OAUTH2_PROXY_REDIRECT_URL: https://oauth2.<mydomain>/oauth2/callback ``` Keeping for future fellow selfhosters - do not be as silly as me.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#458
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?