# Redirect URI is always HTTP - but only in production

**URL:** <https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978>\
**Category:** Get Help\
**Tags:** login, auth0\
**Created:** [May 24, 2022, 9:23am UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978 "2022-05-24T09:23:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![simone.saviolo\_auth0](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/simone.saviolo_auth0/32/33897_2.png) [@simone.saviolo\_auth0](https://community.auth0.com/u/simone.saviolo_auth0)\
**Post date:** [May 24, 2022, 9:23am UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978/1 "2022-05-24T09:23:12Z")

</div>

Hello everyone. First-time Auth0 user here, implementing it in a .Net 6 regular web app. Everything is fine until I deploy my app to Heroku: what happens there is that, when logging in, the redirect URI gets changed to HTTP. At first I managed to hack it by adding the HTTP URI in the allowed callback URIs (which was of course bad), but now an issue surfaced where the correlation cookie, which is marked as Secure, gets stripped in the resulting HTTP request.

My application lives at [this URL](https://sr4fun-results.herokuapp.com/): the home page is public, but if you try to enter any other page (for example the “Events” link at the top) you need to authenticate. It seems like the `Authorize` attribute is redirecting to `http://sr4fun-results.herokuapp.com/account/login`, instead of `https://...`. However, if I visit the HTTPS version of that URL ([https://sr4fun-results.herokuapp.com/Account/Login?ReturnUrl=%2Fevents](https://sr4fun-results.herokuapp.com/Account/Login?ReturnUrl=%2Fevents)), I still get redirected to Auth0 with an HTTP URL as the redirect URI.

I don’t know which part of my setup is involved in transforming the URL scheme, as none specifies it directly. Here is my code:

Program.cs

```auto
// unrelated dependency injection and configuration

builder.Services.ConfigureApplicationCookie(options => 
{
    options.LoginPath = "/account/login";
    options.LogoutPath = "/account/logout";
});
builder.Services.Configure<Auth0Configuration>(builder.Configuration.GetSection("Auth0"));
builder.Services.AddAuth0WebAppAuthentication(options =>
{
	Auth0Configuration auth0Configuration = builder.Configuration.GetSection("Auth0").Get<Auth0Configuration>();
    options.CallbackPath = "/callback";
	options.Domain = auth0Configuration.Domain;
	options.ClientId = auth0Configuration.ClientID;
    options.ClientSecret = auth0Configuration.ClientSecret;
    //options.ResponseType = "code";
});

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
	app.UseExceptionHandler("/Home/Error");
	// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
	app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseCookiePolicy();
//app.UseSession();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.UseStatusCodePagesWithReExecute("/error/{0}");

app.MapControllerRoute(
	name: "default",
	pattern: "{controller=Home}/{action=Index}/{id?}");

app.Run();

```

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![nelson1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nelson1/32/33198_2.png) [@nelson1](https://community.auth0.com/u/nelson1)\
**Post date:** [June 9, 2022, 11:47am UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978/2 "2022-06-09T11:47:55Z")

</div>

Hi,

We have the same issue.  
When the application redirect to the login actin, the scheme is set to HTTP and not https.

everything works correctly on localhost but once deployed on our cloud (AWS beanstalk), the redirectURI is always set to HTTP instead of HTTPS.

@simone.saviolo_auth0 did you find a solution to solve this?  
If yes, could you share it

---

<div class="post-metadata">

**Author:** ![simone.saviolo\_auth0](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/simone.saviolo_auth0/32/33897_2.png) [@simone.saviolo\_auth0](https://community.auth0.com/u/simone.saviolo_auth0)\
**Post date:** [June 9, 2022, 1:25pm UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978/3 "2022-06-09T13:25:19Z")

</div>

More of a workaround than a proper solution, but this is what I’ve been using to explicitly set the redirect URI:

```auto
builder.Services.AddAuth0WebAppAuthentication(options =>
{
	// Other configuration
	options.LoginParameters = new Dictionary<string, string>()
	{
		{ "redirect_uri", $"{auth0Configuration.BaseSiteURL}/callback" },
	};
});

```

I investigated the issue a bit more [on Github](https://github.com/auth0/auth0-aspnetcore-authentication/issues/75), but got no solution.

---

<div class="post-metadata">

**Author:** ![phil.cole](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/phil.cole/32/58826_2.png) [@phil.cole](https://community.auth0.com/u/phil.cole)\
**Post date:** [July 25, 2024, 4:36pm UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978/4 "2024-07-25T16:36:33Z")

</div>

We have had this issue elsewhere previously in our code running in Kubernetes , and now here. I suspect the issues above in Heroku and beanstalk are caused by the same thing.

This is related to how [ASP.NET](http://ASP.NET) Core builds absolute URLs based on the incoming request - [details here](https://stackoverflow.com/questions/59994149/httprequest-inconsistent-scheme-host-properties), summarised nicely in the first comment of the accepted answer.

Basically if you are running in Kubernetes, your browser will make a request over https to the domain name. Kubernetes/nginx will intercept this request and pass it on to your actual app, but using _http_. At the same time, it should add a header “X-Forwarded-Proto” set to https, so you know what the original protocol was.

When [ASP.NET](http://ASP.NET) Core builds the redirect\_uri, it will use the same protocol as its direct request, that is _http_. It doesn’t check for this X-Forwarded-Proto or anything else.

The best way to get around this is by adding the [ForwardedHeaders Middleware](https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-6.0#forwarded-headers-middleware-order) and applying the `XForwardedProto` header:

```auto
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedProto;
});

var app = builder.Build();
app.UseForwardedHeaders(); // note this should be added as early as possible

```

We found this caused problems with another specific part of our code, so another possible option is to manipulate the redirect\_uri in the OIDC event before it is sent to Auth0, similar to suggested in [this post](https://github.com/DuendeSoftware/Support/issues/181#issuecomment-1227905800).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 8, 2024, 4:37pm UTC](https://community.auth0.com/t/redirect-uri-is-always-http-but-only-in-production/83978/5 "2024-08-08T16:37:16Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.