search

jeremy379 / laravel-openid-connect

Implement OpenID Connect inside Laravel
MIT License
26 stars 13 forks source link

Force https:// in discovery response and ID token's issuer #23

Open alecpl opened 2 months ago

alecpl commented 2 months ago

I know this is more of a Laravel general setting/problem, but would it be possible to force https:// in DiscoveryController?

There are url() and route() calls that all return http://, but I need them to be https://.

All URIs MUST use https:// according to the protocol spec. So, I think it should be enforced in your code.

There's also a code in IdTokenResponse::getBuilder() that would need to return https:// for the $issuer.

BTW: URL::forceScheme('https'); does not fix issuer in IdTokeResponse, which might be a bug in itself.