Skip to content

Adding SOCIAL_AUTH_REDIRECT_IS_HTTPS, to enable use of HTTPS protocol when redirecting after login using social auth. #13614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Nov 6, 2025
Merged

Adding SOCIAL_AUTH_REDIRECT_IS_HTTPS, to enable use of HTTPS protocol when redirecting after login using social auth. #13614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6789183
Adding SOCIAL_AUTH_REDIRECT_IS_HTTPS, to enable use of HTTPS protocol…
Nov 4, 2025
4295a23
Adding description about how to setup SOCIAL_AUTH_REDIRECT_IS_HTTPS w…
Nov 4, 2025
db1fb1e
Adding description about how to setup SOCIAL_AUTH_REDIRECT_IS_HTTPS w…
Nov 4, 2025
e50c275
Apply suggestion from @valentijnscholten
valentijnscholten Nov 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/content/en/customize_dojo/user_management/configure_sso.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -511,7 +511,7 @@ If during the login process you get the following error: *The
in the client app settings.* and the `redirect_uri` HTTP
GET parameter starts with `http://` instead of
`https://` you need to add
Copy link
Contributor

@manuel-sommer manuel-sommer Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the wording does not fit to the setting.
and the redirect_uri HTTP
GET parameter starts with https:// instead of
http:// you need to add (because the DD_SOCIAL_AUTH_REDIRECT_IS_HTTPS=(bool, False))

And shouldn't we make this setting always to True just because DefectDojo is a security tool?

Copy link
Contributor

@Maffooch Maffooch Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And shouldn't we make this setting always to True just because DefectDojo is a security tool?

No as the default is false from the lib. We want to avoid potentially breaking SSO for some folks

Copy link
Contributor

@manuel-sommer manuel-sommer Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds legit

`SOCIAL_AUTH_REDIRECT_IS_HTTPS = True` to Docker environment variables, or to your `local_settings.py` file.
`DD_SOCIAL_AUTH_REDIRECT_IS_HTTPS = True` to Docker Compose environment variables, or `SOCIAL_AUTH_REDIRECT_IS_HTTPS` to your `local_settings.py` file.

2. Restart DefectDojo, and 'Login With Okta' should appear on the login screen.

Expand Down
2 changes: 2 additions & 0 deletions dojo/settings/settings.dist.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@
DD_SOCIAL_AUTH_CREATE_USER=(bool, True), # if True creates user at first login
DD_SOCIAL_AUTH_CREATE_USER_MAPPING=(str, "username"), # could also be email or fullname
DD_SOCIAL_LOGIN_AUTO_REDIRECT=(bool, False), # auto-redirect if there is only one social login method
DD_SOCIAL_AUTH_REDIRECT_IS_HTTPS=(bool, False), # If true, the redirect after login will use the HTTPS protocol
DD_SOCIAL_AUTH_TRAILING_SLASH=(bool, True),
DD_SOCIAL_AUTH_OIDC_AUTH_ENABLED=(bool, False),
DD_SOCIAL_AUTH_OIDC_OIDC_ENDPOINT=(str, ""),
Expand Down Expand Up @@ -576,6 +577,7 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param
# Showing login form (form is not needed for external auth: OKTA, Google Auth, etc.)
SHOW_LOGIN_FORM = env("DD_SOCIAL_AUTH_SHOW_LOGIN_FORM")
SOCIAL_LOGIN_AUTO_REDIRECT = env("DD_SOCIAL_LOGIN_AUTO_REDIRECT")
SOCIAL_AUTH_REDIRECT_IS_HTTPS = env("DD_SOCIAL_AUTH_REDIRECT_IS_HTTPS")
SOCIAL_AUTH_CREATE_USER = env("DD_SOCIAL_AUTH_CREATE_USER")
SOCIAL_AUTH_CREATE_USER_MAPPING = env("DD_SOCIAL_AUTH_CREATE_USER_MAPPING")

Expand Down