https://www.ory.sh/ logo
Join Slack
Powered by
I'm using ory network with a custom kratos & h...
# ory-network
s
I'm using ory network with a custom kratos & hydra UI. I'm trying to host my UI over https, but the browser flow API keeps setting the scheme of the kratos 
self-service/login?flow
URL (the 
action
of the login form) to http. What sets this public URL for kratos? I can't seem to change it. It's correctly set to my custom domain, but the scheme is wrong (http).
Strangely, RequestUrl is also seen by kratos as http, even though the request/redirect is definitely being made over https.
When custom UI is set to 
/ui/login
, flows give https urls as the 
action
. When custom UI is set to https://auth.mycustomdomain.com/login, 
action
is set to http://api.auth.mycustomdomain.com/self-service/login?flow=xyz
h
that’s really strange
Copy code
ory get identity-config --format yaml {preoject-id}
what is 
serve.public.url
for you?
s
It's set to my ory project URL
I'm using the tunnel like so: 
ory tunnel --project $SLUG <https://auth.mycustomdomain.com>
<https://api.auth.mycustomain.com> --cookie-domain <http://auth.mycustomdomain.com|auth.mycustomdomain.com>
https://github.com/ory/cli/blob/master/cmd/cloudx/proxy/proxy.go#L282 The output here is correct (https)
I'm thinking it's maybe something in the tunnel. Whatever is rewriting URLs from my project URL to the tunnel URL.
Is the tunnel's functionality fully open source? I don't know what happens with https://github.com/ory/cli/blob/master/cmd/cloudx/proxy/proxy.go#L216
Is the rewriting of URLs something that happens within Ory network/closed source?
Geez, finally figured it out. 
X-Forwarded-Proto
needed to be set to 
https
. Not really sure why - the client is making the requests over https.
p
Hi @straight-actor-10624 Are you deploying the Ory tunnel in production? And you have a custom domain on the project? If this is the case, please remove the ory tunnel an only rely on the custom domain. https://www.ory.sh/docs/guides/custom-domains
s
I am deploying in production, and chose to use tunnel rather than cname.
2 Views
Open in Slack
PreviousNext
Powered by