microsoft / oxa-tools

Open edX on Azure Tools
MIT License
36 stars 103 forks source link

Force edX django service social auth to use https for redirect URIs #433

Closed btelnes closed 5 years ago

btelnes commented 5 years ago

What does this PR do? Please provide some context

Adds CREDENTIALS_SOCIAL_AUTH_REDIRECT_IS_HTTPS to force edX django service social auth to use https for redirect URIs.

Where should the reviewer start?

server-vars.yml

How can this be manually tested? (brief repro steps and corpnet-URL with change)

Deploy Hawthorn. Check the Set-Cookie: edx-user-info prarmeter for the secure attribute for auth/complete/azuread-oauth2/.

What are the relevant TFS items? (list id numbers)

Task 877056

Definition of done:

Reminders DURING merge

  1. If you're merging from a short-term (feature) branch into a long-term branch (like dev, release, or master) then "Squash and merge" to keep our history clean.
  2. If merging from two longterm branches (like cherry picks from upstream, dev to release, etc) then "Create merge commit" to preserve individual commits.