title: How to configure Spring Boot to use OIDC while app is behind an SSL termination proxy
body: <p>I am trying to configure a Spring Boot app to use OIDC. The server is behind an SSL termination proxy.</p>
  <p>Here are the properties I use:</p>
  <pre><code>spring:
    security:
      oauth2:
        client:
          provider:
            oidc:
              authorization-uri: https://example.org/oidc/oauth2/authorize
              token-uri: https://example.org/oidc/oauth2/access_token
              user-info-uri: https://example.org/oidc/oauth2/userinfo
              jwk-set-uri: https://example.org/oidc/oauth2/connect/jwk_uri
              custom-params: param_name1,param_value1,param_name2,param_value2,nonce,123456789
          registration:
            oidc:
              client-id: myclientid
              client-secret: myclientsecret
              authorization-grant-type: authorization_code
              scope:
                - openid
                - email
                - profile
              redirect-uri: https://mydomain/myapp/login/oauth2/code/oidc
  </code></pre>
  <p>Here's where it goes wrong:</p>
  <p><strong>1. The OIDC server requires a nonce param to be added to the request URL</strong></p>
  <p>I have solved this by using a custom OAuth2AuthorizationRequest that reads the custom-params property and appends those values to the request URL</p>
  <p><strong>2. The OidcAuthorizationCodeAuthenticationProvider throws an exception caused by invalid_redirect_uri_parameter</strong></p>
  <p>I have tried many approaches to fix this.</p>
  <p>I have tried creating a filter that adds the X-Forwarded-Proto to the request (because the proxy doesn't handle that).</p>
  <p>The headers are added, I have also added the following properties:</p>
  <pre><code>server:
      forward-headers-strategy: native
      tomcat.protocol-header: x-forwarded-proto
  </code></pre>
  <p>But it doesn't seem to work.</p>
  <p>OidcAuthorizationCodeAuthenticationProvider still throws an exception because this condition is false:</p>
  <pre><code>!authorizationResponse.getRedirectUri().equals(authorizationRequest.getRedirectUri())
  </code></pre>
  <p>I have debugged the code and the only difference is one being http and the other https.</p>
  <p><em>I have found a VERY hacky solution that I don't like at all, which is another filter that modifies the URL just for that particular URL.</em></p>
  <p>I would prefer a more elegant solution.</p>
  <p><strong>3. When using the custom nonce parameter, the OidcAuthorizationCodeAuthenticationProvider throws an exception cause by invalid_nonce</strong></p>
  <p>Now I am stuck. I considered writing my own Authentication Provider, but I have no guarantee that mine will be picked up before the OIDC one provided by Spring.</p>
  <p>And with the nonce, it's a catch 22:</p>
  <ul>
  <li><p>if I don't use the custom param, I couldn't find a way to make Spring add the nonce to the request</p>
  </li>
  <li><p>if I use that one, Spring doesn't recognize it when it's part of the JWT and freaks out</p>
  </li>
  </ul>
  <p><strong>Any help would be GREATLY appreciated, as this has been driving me nuts for days if not weeks.</strong></p>
  <p>Thank you.</p>
  <p><strong>EDIT</strong></p>
  <p>The 2 urls that are compared in case 2 come from:</p>
  <ul>
  <li>OAuth2AuthorizationRequest</li>
  <li>OAuth2AuthorizationResponse</li>
  </ul>
  <p><em><strong>OAuth2AuthorizationRequest</strong></em> is built in the
  OAuth2AuthorizationRequestRedirectFilter at the following line:</p>
  <pre><code>OAuth2AuthorizationRequest authorizationRequest = this.authorizationRequestResolver.resolve(request);
  </code></pre>
  <p>The redirect uri is built in DefaultOAuth2AuthorizationRequestResolver.expandRedirectUri() which calls</p>
  <pre><code>UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
  </code></pre>
  <p><em><strong>OAuth2AuthorizationResponse</strong></em> is built in the OAuth2LoginAuthenticationFilter.attemptAuthentication() which also calls</p>
  <pre><code>UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
  </code></pre>
  <p>and then</p>
  <pre><code>OAuth2AuthorizationResponseUtils.convert(params, redirectUri)
  </code></pre>
  <p>I will double check, but I don't remember UriComponentsBuilder.adaptFromForwardedHeaders(HttpHeaders headers) being called when building these URLs.</p>
  <p>And even if that works, that still leaves the nonce issue :(</p>