Force https:// in redirect URIs if setting is defined. Closes #281

diff --git a/README.rst b/README.rst
index 90a0c1f594a1d7eb9e7a885413430994f8af8b95..93afa6b9da8b2903f0e2859aee34def7132f0792 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -368,6 +368,13 @@ Configuration
   It's default value is ``DEBUG``, so you need to set it to ``False`` to avoid
   tracebacks when ``DEBUG = True``.
 
+- When your project is behind a reverse proxy that uses HTTPS the redirect URIs
+  can became with the wrong schema (``http://`` instead of ``https://``), and
+  might cause errors with the auth process, to force HTTPS in the final URIs
+  define this setting::
+
+    SOCIAL_AUTH_REDIRECT_IS_HTTPS = True
+
 
 Some settings can be tweak by backend by adding the backend name prefix (all
 uppercase and replace ``-`` with ``_``), here's the supported settings so far::

diff --git a/doc/configuration.rst b/doc/configuration.rst
index d7db11196f200c799f2d99e5e6f99ffdd337af3f..fadf215a196771e77b3e438535e3d7425a284ec5 100644 (file)
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -265,6 +265,12 @@ Configuration
   It's default value is ``DEBUG``, so you need to set it to ``False`` to avoid
   tracebacks when ``DEBUG = True``.
 
+- When your project is behind a reverse proxy that uses HTTPS the redirect URIs
+  can became with the wrong schema (``http://`` instead of ``https://``), and
+  might cause errors with the auth process, to force HTTPS in the final URIs
+  define this setting::
+
+    SOCIAL_AUTH_REDIRECT_IS_HTTPS = True
 
 Some settings can be tweak by backend by adding the backend name prefix (all
 uppercase and replace ``-`` with ``_``), here's the supported settings so far::

diff --git a/social_auth/backends/__init__.py b/social_auth/backends/__init__.py
index 1ce28c5561ab4d4019c65a82c49f05bc206586ed..c1d2baeedf15070d60c3686e7d3a1fb44b366d81 100644 (file)
--- a/social_auth/backends/__init__.py
+++ b/social_auth/backends/__init__.py
@@ -410,6 +410,15 @@ class BaseAuth(object):
         else:
             user.social_auth.filter(provider=self.AUTH_BACKEND.name).delete()
 
+    def build_absolute_uri(self, path=None):
+        """Build absolute URI for given path. Replace http:// schema with
+        https:// if SOCIAL_AUTH_REDIRECT_IS_HTTPS is defined.
+        """
+        uri = self.request.build_absolute_uri(path)
+        if setting('SOCIAL_AUTH_REDIRECT_IS_HTTPS'):
+            uri = uri.replace('http://', 'https://')
+        return uri
+
 
 class OpenIdAuth(BaseAuth):
     """OpenId process handling"""
@@ -419,26 +428,25 @@ class OpenIdAuth(BaseAuth):
         """Return auth URL returned by service"""
         openid_request = self.setup_request(self.auth_extra_arguments())
         # Construct completion URL, including page we should redirect to
-        return_to = self.request.build_absolute_uri(self.redirect)
+        return_to = self.build_absolute_uri(self.redirect)
         return openid_request.redirectURL(self.trust_root(), return_to)
 
     def auth_html(self):
         """Return auth HTML returned by service"""
         openid_request = self.setup_request(self.auth_extra_arguments())
-        return_to = self.request.build_absolute_uri(self.redirect)
+        return_to = self.build_absolute_uri(self.redirect)
         form_tag = {'id': 'openid_message'}
         return openid_request.htmlMarkup(self.trust_root(), return_to,
                                          form_tag_attrs=form_tag)
 
     def trust_root(self):
         """Return trust-root option"""
-        return setting('OPENID_TRUST_ROOT') or \
-               self.request.build_absolute_uri('/')
+        return setting('OPENID_TRUST_ROOT') or self.build_absolute_uri('/')
 
     def continue_pipeline(self, *args, **kwargs):
         """Continue previous halted pipeline"""
         response = self.consumer().complete(dict(self.data.items()),
-                                            self.request.build_absolute_uri())
+                                            self.build_absolute_uri())
         kwargs.update({
             'auth': self,
             'response': response,
@@ -449,7 +457,7 @@ class OpenIdAuth(BaseAuth):
     def auth_complete(self, *args, **kwargs):
         """Complete auth process"""
         response = self.consumer().complete(dict(self.data.items()),
-                                            self.request.build_absolute_uri())
+                                            self.build_absolute_uri())
         if not response:
             raise AuthException(self, 'OpenID relying party endpoint')
         elif response.status == SUCCESS:
@@ -521,7 +529,7 @@ class BaseOAuth(BaseAuth):
     def __init__(self, request, redirect):
         """Init method"""
         super(BaseOAuth, self).__init__(request, redirect)
-        self.redirect_uri = self.request.build_absolute_uri(self.redirect)
+        self.redirect_uri = self.build_absolute_uri(self.redirect)
 
 
 class ConsumerBasedOAuth(BaseOAuth):