Enable assume_ssl for reverse proxy HTTPS callback URLs #155

Closed

ldraney wants to merge 1 commit from 154-enable-assume-ssl into main

ldraney commented

2026-06-07 04:19:29 +00:00

Owner

Summary

Enable config.assume_ssl so Rails trusts X-Forwarded-Proto from the Tailscale funnel reverse proxy
Without this, OmniAuth builds http:// callback URLs which Keycloak rejects as invalid_redirect_uri

Closes #154

Changes

config/environments/production.rb: Uncomment config.assume_ssl = true (line 28)

Test Plan

Click "Sign in with Keycloak" shows Keycloak login form (not grey error page)
Successful login redirects back to app as authenticated user
Super admin sees admin tabs after login

Review Checklist

One-line config change, no new dependencies
No test changes needed (production config only)

Forgejo issue: #154

## Summary - Enable `config.assume_ssl` so Rails trusts X-Forwarded-Proto from the Tailscale funnel reverse proxy - Without this, OmniAuth builds `http://` callback URLs which Keycloak rejects as invalid_redirect_uri Closes #154 ## Changes - `config/environments/production.rb`: Uncomment `config.assume_ssl = true` (line 28) ## Test Plan - [ ] Click "Sign in with Keycloak" shows Keycloak login form (not grey error page) - [ ] Successful login redirects back to app as authenticated user - [ ] Super admin sees admin tabs after login ## Review Checklist - [x] One-line config change, no new dependencies - [x] No test changes needed (production config only) ## Related Notes - Forgejo issue: #154

ldraney added 1 commit

2026-06-07 04:19:29 +00:00

Enable assume_ssl for reverse proxy HTTPS callback URLs

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

CI / scan_ruby (pull_request) Has been cancelled

Details

CI / scan_js (pull_request) Has been cancelled

Details

CI / lint (pull_request) Has been cancelled

Details

589df81bfb

The app runs behind a Tailscale funnel that terminates TLS. Without
assume_ssl, Rails ignores X-Forwarded-Proto and OmniAuth builds
http:// callback URLs. Keycloak rejects these as invalid_redirect_uri.

Enabling assume_ssl makes Rails trust the forwarded proto header so
callback URLs use https:// as Keycloak expects.

Closes #154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ldraney commented

2026-06-07 04:20:10 +00:00

Author

Owner

PR Review: #155 — Enable assume_ssl for reverse proxy HTTPS callback URLs

Parent issue: #154

Diff Analysis

Single-line change in config/environments/production.rb: uncomments config.assume_ssl = true.

Findings

Correctness: The change is correct. config.assume_ssl is the standard Rails 7.1+ mechanism for apps behind SSL-terminating reverse proxies. It makes Rails trust X-Forwarded-Proto and X-Forwarded-Port headers, ensuring request.ssl? returns true and URL helpers generate https:// URLs. This directly fixes the OmniAuth invalid_redirect_uri error where callback URLs were being built with http:// instead of https://.

Scope: Minimal and appropriate. One line, production config only. No test changes needed since this is infrastructure configuration, not application logic.

Risk: Very low. The app is confirmed to run behind a Tailscale funnel (SSL-terminating proxy), so enabling this setting matches the actual deployment topology.

No issues found.

VERDICT: APPROVED

## PR Review: #155 — Enable assume_ssl for reverse proxy HTTPS callback URLs **Parent issue:** #154 ### Diff Analysis Single-line change in `config/environments/production.rb`: uncomments `config.assume_ssl = true`. ### Findings **Correctness:** The change is correct. `config.assume_ssl` is the standard Rails 7.1+ mechanism for apps behind SSL-terminating reverse proxies. It makes Rails trust `X-Forwarded-Proto` and `X-Forwarded-Port` headers, ensuring `request.ssl?` returns true and URL helpers generate `https://` URLs. This directly fixes the OmniAuth `invalid_redirect_uri` error where callback URLs were being built with `http://` instead of `https://`. **Scope:** Minimal and appropriate. One line, production config only. No test changes needed since this is infrastructure configuration, not application logic. **Risk:** Very low. The app is confirmed to run behind a Tailscale funnel (SSL-terminating proxy), so enabling this setting matches the actual deployment topology. **No issues found.** ### VERDICT: APPROVED