The redirect after revoking permissions seems not use public origin.

[oclaude]

Hello,

In my environment, I'm in https until the load balancer, after it all traffic is http.
In the identiy server options, I have configured the public origin to https://...

All works fine except when I try to revoking a permission.
The action is correctly executed but the redirect fails because I'm redirected over http without using my public origin.

A workaround is to rewrite location header in the reverse proxy.

Thank you for this fix.

[brockallen]

Yep, confirmed as a bug. Fixed in 2.4