I have a Spring app and a React act written so that the user can use facebook to login. I have also bought a domain with an SSL certificate and installed the certificate in my nginx reverse proxy.
Here is my nginx config (it runs in a docker container):
events {
worker_connections 1024;
}
http {
server {
listen 80;
server_name frontend;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://host.docker.internal:3000/;
}
}
server {
listen 443 ssl;
server_name frontend_secure;
ssl_certificate /etc/ssl/private/8e3a263352b3f661.pem;
ssl_certificate_key /etc/ssl/private/key.key;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://host.docker.internal:3000;
}
location /api {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://host.docker.internal:8081;
}
}
}
I added my https domain to the App Domains, Site URL, Domains and Valid OAuth Redirect URIs in the Facebook console. In the backend spring config I have my https domain setup as the login success url:
http.authorizeRequests()
.antMatchers("/api/users/login**", "/callback/", "/webjars/**", "/error**", "/api/users/availableAuths").permitAll()
.antMatchers("/oauth_login", "/loginFailure", "/").permitAll()
.anyRequest().authenticated()
.and()
.oauth2Login()
.defaultSuccessUrl("https://domain.dev/", true)
.failureUrl("/loginFailure")
.loginPage("/api/users/availableAuths")
.and()
.logout()
.logoutUrl("/");
I can see the frontend properly (with secure https) and it redirects to facebook correctly to login. The problem is that when I login I get this message:
Facebook has detected Eat App isn't using a secure connection to transfer information.
Until Eat App updates its security settings, you won't be able to use Facebook to log into it.
I can see that in the link where facebook stops there is
https://www.facebook.com/v2.8/dialog/oauth? (...) redirect_uri=http%3A%2F%2Fdomain.dev%2Fapi%2Flogin%2Foauth2%2Fcode%2Ffacebook
So the redirect_uri
in the facebook url is HTTP and not HTTPS. Why is that? Where does this redirect_uri
param with http come from?