Auth0-Java-MVC-Common SDK With Reverse Proxy has 403 Error: The Redirect URI is Wrong
Last Updated:
Overview
When using the auth0-java-mvc-common SDK, the following error is returned when using the SDK with SSL termination:
com.auth0.exception.APIException: Request failed with status code 403: The redirect URI is wrong. You sent http://<domain1>, and we expected https://<domain2> at com.auth0.net.ExtendedBaseRequest.createResponseException(ExtendedBaseRequest.java:131) ~[auth0-1.44.1.jar:1.44.1]
Applies To
- Java
- Reverse Proxy
- SSL Termination
Cause
The SDK cannot be used with Secure Sockets Layer (SSL) termination (a proxy that is not configured with end-to-end encryption).
When composing the redirect_uri parameter for the token exchange request, the SDK automatically detects and uses the schema on which the application is running (http). As a result, it creates inconsistency between the expected value (https://...) and the actual value (http://...).
Solution
Ensure any proxy used in the connection is configured with end-to-end SSL Encryption.
