Redirecting to http instead of https

[tulasinadhv]

If you'd like to report a bug in Flask-Appbuilder, fill out the template below. Provide
any extra information that may be useful

Responsible disclosure:
We want to keep Flask-AppBuilder safe for everyone. If you've discovered a security vulnerability
please report to danielvazgaspar@gmail.com.

Environment

Flask-Appbuilder version:
Flask-Bcrypt==0.7.1

pip freeze output:

Flask==1.1.2
Flask-Admin==1.5.4
Flask-AppBuilder==2.2.0
Flask-Babel==0.12.2
Flask-Bcrypt==0.7.1
Flask-Caching==1.3.3
Flask-JWT-Extended==3.18.2
Flask-Login==0.4.1
Flask-OAuthlib==0.9.5
Flask-OpenID==1.2.5
Flask-SQLAlchemy==2.4.0
flask-swagger==0.2.13
Flask-WTF==0.14.2

Describe the expected results

Should be able to sign in with Google Authenticator, submitted the redirect_URL also in the google oauthenticator
but getting the response as http instead of https not able to authenticate with google.

[08/Jul/2021:12:39:46 +0530] "GET /login/google?next=http://mydomain.com/home HTTP/1.1" 302 1073

Describe the actual results

Tell us what happens instead.

It should be GET /login/google?next=https://mydomain.com/home HTTP/1.1" 302 1073

Steps to reproduce

Use OAUTH_PROVIDERS with https url in Airflow
ref ticket: https://stackoverflow.com/questions/55105018/airflow-google-authentication-does-not-work-as-expected

[tetsuya0617]

I have the same issue.

[rakeshadk7]

I am facing the same issue, on version 3.3.2

[oofnikj]

Is your application deployed behind a load balancer? I experienced the same issue with Apache Superset until I enabled the ProxyFix werkzeug middleware module: https://werkzeug.palletsprojects.com/en/2.0.x/middleware/proxy_fix/

In short, the problem arises when your app is being served over HTTP but your clients are connecting over HTTPS. By default, Flask doesn't care about the X-Forwarded-Proto HTTP header, so it will send a http:// redirect URI to your identity provider instead of HTTPS. ProxyFix will set wsgi.url_scheme to the correct value on each request.

Here is how Superset exposes this configuration option:
apache/superset#8117

[piyush-daga]

If anyone is facing this issue for Airflow and came here regarding that, this comment solved my issue: #apache/airflow#17536 (comment)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Feel free to reopen it if it's still relevant to you. Thank you