(insecure_transport) OAuth 2 MUST utilize https.

[higuchi-toshio-intec]

Very thanks for your project.

My execution environment is built with these versions.

• AWS Fargate
  • CKAN [2.9.5]
  • ckanext-oauth2 [0.7.0]
• Amazon ELB (for "https" front-end listener)
• Amazon Cognito

On my execution environment, I got a error.

I tried to fix it.
I hope you like the following.

diff --git a/ckanext/oauth2/oauth2.py b/ckanext/oauth2/oauth2.py
index 28a2724..cc9c782 100644
--- a/ckanext/oauth2/oauth2.py
+++ b/ckanext/oauth2/oauth2.py
@@ -115,10 +115,14 @@ class OAuth2Helper(object):
             )
 
         try:
+            req_url = toolkit.request.url
+            ckan_site_url = os.environ.get('CKAN_SITE_URL')
+            if (ckan_site_url.startswith("https:")):
+                req_url = req_url.replace("http:", "https:")
             token = oauth.fetch_token(self.token_endpoint,
                                       headers=headers,
                                       client_secret=self.client_secret,
-                                      authorization_response=toolkit.request.url,
+                                      authorization_response=req_url,
                                       verify=self.verify_https)
         except requests.exceptions.SSLError as e:
             # TODO search a better way to detect invalid certificates

regards

[aitormagan]

Hi. This is a well-known “issue” which is documented here: https://github.com/conwetlab/ckanext-oauth2/wiki/Activating-and-Installing. In case your OAuth server is using HTTP, you must set an environment variable. Regards Aitor

…

El 3 ago 2022, a las 7:37, higuchi-toshio-intec ***@***.***> escribió:  Very thanks for your project. My execution environment is built with these versions. AWS Fargate CKAN [2.9.5] ckanext-oauth2 [0.7.0] Amazon ELB (for "https" front-end listener) Amazon Cognito On my execution environment, I got a error. I tried to fix it. I hope you like the following. diff --git a/ckanext/oauth2/oauth2.py b/ckanext/oauth2/oauth2.py index 28a2724..cc9c782 100644 --- a/ckanext/oauth2/oauth2.py +++ b/ckanext/oauth2/oauth2.py @@ -115,10 +115,14 @@ class OAuth2Helper(object): ) try: + req_url = toolkit.request.url + ckan_site_url = os.environ.get('CKAN_SITE_URL') + if (ckan_site_url.startswith("https:")): + req_url = req_url.replace("http:", "https:") token = oauth.fetch_token(self.token_endpoint, headers=headers, client_secret=self.client_secret, - authorization_response=toolkit.request.url, + authorization_response=req_url, verify=self.verify_https) except requests.exceptions.SSLError as e: # TODO search a better way to detect invalid certificates regards — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.

[higuchi-toshio-intec]

Hi,

I want to use secure transport.

I installed CKAN from Docker Compose.
It supports "http" only.
Then using Amazon ELB for "https" front-end listener.

Please image this.

Cognito <== https ==> Amazon ELB [ (inside AWS) <== http ==> CKAN(docker) ]

In this case,
Shouldn't CKAN (docker) redirect 'https' addresses?

[frafra]

This is an issue with your CKAN setup; I would suggest look for help there.
Have you used https:// for CKAN_SITE_URL?
Have you looked at the previous issues? #44.