DiscourseConnect generates HTTP redirects even with force_https on

[supermathie (Michael Brown)]

@matiasgarciaisaia

tell my Traefik to add an X-Forwarded-Proto: https header

This is how we do it on our hosting platform; we have a load balancer layer that sets X-Forwarded-Proto for the downstream nginx+Discourse to consume.

We don’t need any additional shenanigans to make it work - I’m not sure what’s going wrong for you here.

@matiasgarciaisaia

Once again, I think if there’s a force_https setting, Discourse-the-rails-app should honor it, regardless of what the reverse proxy or other parties handle or not.

This is indeed what happens:

  def self.generate_sso(return_path = "/", secure_session:)
    sso = new(secure_session: secure_session)
    sso.nonce = SecureRandom.hex
    sso.register_nonce(return_path)
    sso.return_sso_url = Discourse.base_url + "/session/sso_login"
    sso
  end

and base_url comes from:

  def self.base_protocol
    SiteSetting.force_https? ? "https" : "http"
  end

  def self.base_url_no_prefix
    "#{base_protocol}://#{current_hostname_with_port}"
  end

  def self.base_url
    base_url_no_prefix + base_path
  end