Tukukkk

The above configuration has an asp.net core app using google authentication. But for some reason the authentication redirect to Google was sending a redirect URI using http instead of https. No matter where I look, there doesn't seem to have a way to change this in the middleware.

On the apache side, I followed a tutorial that supposedly forwards the protcol using

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}

However it does not work correctly. More information below and interesting security ramifications.

Now, since kestrel is running http it defaults to setting the "redirect URI" for google authentication to use the http protocol.

I have the above scenario working with http redirect URIs. I've wiresharked this and it works with the HTTP redirect URI! Hmm, I'm only allowing https in though. So I tcpdump the interaction on my server and I find that because apache requires https, it throws an HTTP 301 moved permanently to https. Great that's what I would expect. What I didn't expect was Google to redirect to the https protocol. OK, not ideal, but it works so why am I asking? It sends the data over http first to get the 301 so I've lost encryption at that point. If someone is snooping, they can read Google's entire response. I.e. I can see google post back on http with tcpdump.

Below is the only code relating to Authentication:

services.AddAuthentication(options =>

        {

            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;

            options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;

            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

        })

        .AddGoogle(options =>

        {

            options.ClientId = Configuration["Authentication:Google:ClientId"];

            options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];

        })

        .AddCookie(options =>

        {

            options.LoginPath = "/auth/signin";

        });

Note, that in my code I am NOT using app.UseHttpsRedirection();

Although, I'm still interested in finding a way to change the value of the Redirect URI sent to google from asp.net core using the ".AddGoogle" authentication, I was able to solve the problem by changing the apache configuration to:

RequestHeader set "X-Forwarded-For"

RequestHeader set "X-Forwarded-Proto" "https"

Essentially hardcoding the protocol forced it to pass "https" to the asp.net core middleware and it now works correctly.