Is there a way to force the redirect uri to be https ?

[brahma-dev]

I have setup sveltekit behind nginx, which also handles https.
The redirect uri generated though is http only. How can I force it to be https ?

[Dan6erbond]

Hey there, you can use the redirect callback as seen in the README or better, specify the host in the config when constructing SvelteKitAuth. A reference for AuthConfig in auth.ts.

[Dan6erbond]

Hmm. Interesting. That means there's a bug somewhere in the flow. Do you mind creating an issue on this and mention the provider you use?

As for using https: for redirects - did setting the host in the config work for this purpose?

[brahma-dev]

It appears that the root of the problem is that svelte doesn't provide protocol: sveltejs/kit#1240 / sveltejs/kit#1241
So I'll wait until they fix that.

For now I am patching up sk-auth in postinstall
"postinstall": "sed -i 's/http:\\/\\/\\${host}/https:\\/\\/\\${host}/' ./node_modules/sk-auth/dist/auth.js"

[Dan6erbond]

Well, the redirect() callback should definitely work, so we'll be looking into that, and I already created an issue. See #39.

On top of that our config provides the host option as you can see here. So you shouldn't have to patch the library at all:

interface AuthConfig {
  providers: Provider[];
  callbacks?: AuthCallbacks;
  jwtSecret?: string;
  jwtExpiresIn?: string | number;
  host?: string;
  basePath?: string;
}

That config option is used by getBaseUrl() in auth.ts which means you definitely won't have to patch up anything. In fact, you're patching that precise line where you could just substitute it with the usage of that config value, allowing SvelteKitAuth to still work in development with HTTP and switch to HTTPS in production using environment variables.

[brahma-dev]

The issue is that I am using the host header to get the hostname. I can't have it in the environment variable. The only thing I can ensure is that it will always be https.

The patch solves it for now. Whenever svelte kit starts providing the protocol we can use that.

[Dan6erbond]

Ah, I see. That's an interesting use-case. In that case, stay subscribed to #39 so you can use the redirect() callback once we get that working again!