OIDCXForwardedHeaders not being taken into account since 2.4.16

[maltesmann]

Hi there,

I am using mod_auth_openidc behind a reverse proxy as described here: https://github.com/OpenIDC/mod_auth_openidc/wiki#8-how-do-i-run-mod_auth_openidc-behind-a-reverse-proxy

But since upgrading from 2.4.15.7 → 2.4.16 I get an 500 Internal Server Error accessing my site. The error log says:

Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Host received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Port received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/cfg/cfg.c"] [line 438] [level 4] oidc_check_x_forwarded_hdr: header X-Forwarded-Proto received but OIDCXForwardedHeaders not configured for it
Apache-Error: [file "src/handle/request.c"] [line 61] [level 3] oidc_request_check_cookie_domain: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of th
e URL being accessed (http): the "state" and "session" cookies will not be shared between the two!

But my configuration hasn't changed and still looks like this:

<VirtualHost *:80>

  [...]
  OIDCRedirectURI https://[...]/protected/redirect_uri
  [...]
  OIDCXForwardedHeaders X-Forwarded-Proto
  
  ProxyRequests on
  ProxyPreserveHost Off

  <Location /ui>
    AuthType openid-connect
    <RequireAll>
      Require valid-user
    </RequireAll>
    ProxyPass http://localhost:9000
    ProxyPassReverse http://localhost:9000
  </Location>

  [...]

The relevant Headers from the reverse proxy are:

Host: [...]
X-Forwarded-Proto: https
X-Forwarded-Host: [...]
X-Forwarded-Port: 443

I already tried to also configure the X-Forwarded-Host and X-Forwarded-Port headers, but that doesn't change anything.

Downgrading back to 2.4.15.7 solves the issue.

Could this be a bug in 2.4.16 or was there some change in configuration I am missing?

[zandbelt]

that's a bug indeed, we'll release 2.4.16.1 and pull 2.4.16, thanks for reporting

[ArthurAttout]

Is it possible this bug re-appeared in 2.4.18.1 ?
I'm receiving the exact same issue despite setting the correct headers

<VirtualHost *:80>

        LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so
        LoadModule auth_openidc_module /usr/lib/apache2/modules/mod_auth_openidc.so

        ServerAdmin webmaster@localhost
        DocumentRoot /var/www

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined


        # Configure Reverse Proxy entries
        #ProxyPreserveHost On
        RewriteEngine On

        RequestHeader set X-Forwarded-Proto https
        RequestHeader set X-Forwarded-Port 443
        RequestHeader set X-Forwarded-Host mydomain.com
        OIDCProviderMetadataURL https://login.microsoftonline.com/<redacted>/v2.0/.well-known/openid-configuration

        OIDCRedirectURI https://mydomain.com/redirect

        OIDCClientID ${OIDC_CLIENT_ID}
        OIDCClientSecret ${OIDC_CLIENT_SECRET}

        # Randomly generated value, it is not really secret per-se
        OIDCCryptoPassphrase 47ff4d26ab11575c60029

        OIDCScope "openid profile"
        OIDCRemoteUserClaim extensionAttribute15
        OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto

<Location /redirect>
    AuthType openid-connect
    Require claim extensionAttribute15:123456

    ProxyPass http://orc-server/
    ProxyPassReverse http://orc-server/
</Location>

This appears in the logs

reverse-proxy  | [Thu Oct 02 08:58:17.871071 2025] [auth_openidc:warn] [pid 18:tid 18] [client 10.242.23.19:5806] oidc_check_x_forwarded_hdr: OIDCXForwardedHeaders configured for header X-Forwarded-Host but not found in request
reverse-proxy  | [Thu Oct 02 08:58:17.871089 2025] [auth_openidc:warn] [pid 18:tid 18] [client 10.242.23.19:5806] oidc_check_x_forwarded_hdr: OIDCXForwardedHeaders configured for header X-Forwarded-Port but not found in request
reverse-proxy  | [Thu Oct 02 08:58:17.871091 2025] [auth_openidc:warn] [pid 18:tid 18] [client 10.242.23.19:5806] oidc_check_x_forwarded_hdr: OIDCXForwardedHeaders configured for header X-Forwarded-Proto but not found in request
reverse-proxy  | [Thu Oct 02 08:58:17.872011 2025] [auth_openidc:warn] [pid 18:tid 18] [client 10.242.23.19:5806] oidc_state_cookies_clean_expired: state (mod_auth_openidc_state_ojLqy5m9bhiKjPTHbDU6-IEgg2k) has expired (original_url=http://mydomain.com/redirect/requirements.txt)
reverse-proxy  | [Thu Oct 02 08:58:17.872037 2025] [auth_openidc:error] [pid 18:tid 18] [client 10.242.23.19:5806] oidc_request_check_cookie_domain: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!

[zandbelt]

I believe you need to set the headers with the "early" flag to be available to an authentication handler like mod_auth_openidc, see https://serverfault.com/a/415120

[ArthurAttout]

Spot on. I'm currently doing die & retry, at some point I had it working, but I'm 100% sure never setting up the early attribute.
Maybe it was in a position where mod_auth_openidc could see them despite early not being set.