[v3.0.0-next.2] Post Logout Redirect URI proto set incorrectly when behind TLS-terminating reverse proxy

[heikkilamarko]

I've encountered an issue with the post logout redirect URI protocol being set incorrectly when my API is behind a TLS-terminating reverse proxy. Despite configuring the post logout redirect URL with the "https://" protocol, the SDK implementation sets the protocol to "http." This is likely due to the reverse proxy terminating TLS and calling the service without TLS.

zitadel-go/pkg/authentication/authenticate.go

Lines 131 to 133 in aad6fea

	proto := "http"
	if req.TLS != nil {
	proto = "https"

[hifabienne]

@livio-a can you help here?

[gmatu1]

Is there any progress on this issue?

I have the same problem.
TLS is terminated on kubernetes ingress, so as pointed out by heikkilamarko the line 132 returns false and the query param to auth-server always contains "post_logout_redirect_uri=http://..."

Solution would be to specify postLogoutRedirectUri as additional parameter to authentication.New() or at least to reuse the protocol from redirectUri.

[github-actions]

🎉 This issue has been resolved in version 3.2.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀