Google OAuth behind a reverse proxy does not work

[Mrtenz]

Bug description
I'm running Portainer behind a Traefik proxy, to serve it over HTTPS on a specific domain name. When I try to login using Google OAuth, Portainer thinks it is running on my IP address instead, and I end up with this error on Google:

Error: invalid_request

Invalid parameter value for redirect_uri: Raw IP addresses not allowed: http://[MY IP ADDRESS]:9000

The domain name I'm using is not specified as the redirect_uri, even though it's configured like that on Google's end.

Expected behavior
Portainer should use the domain name instead of the IP address of the server as redirect_uri for Google OAuth, when running behind a reverse proxy.

Steps to reproduce the issue:

1. Set up Portainer with Google OAuth
2. Set up a reverse proxy such as Traefik, to serve Portainer over a specific domain name (e.g. example.com)
3. Navigate to example.com and try to log in using Google

Technical details:

• Portainer version:

• Docker version (managed by Portainer): 18.06.3-ce

• Platform (windows/linux): Linux

• Command used to start Portainer (docker run -p 9000:9000 portainer/portainer):

  version: '2'
  
  services:
    portainer:
      image: portainer/portainer
      command: -H unix:///var/run/docker.sock
      restart: always
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
        - ./data:/data
      networks:
        - traefik
      labels:
        - 'traefik.backend=portainer'
        - 'traefik.port=9000'
        - 'traefik.frontend.rule=Host:my.domain.com'
        - 'traefik.frontend.headers.SSLRedirect=true'
        - 'traefik.frontend.passHostHeader=true'
        - 'traefik.enable=true'
  
  networks:
    traefik:
      external: true
  

• Browser: Google Chrome

[ghost]

cc @ncresswell for an update on this

[ncresswell]

We dont actually support (have not designed for) Portainer with oAUTH when behind a reverse proxy.

There are other projects reporting similar issues, and some have reported success with setting ForwardedHeaderTransformer in their proxy settings.

[ghost]

Then I think this should be labelled as a feature request to support Oauth behind reverse proxy

[danner26]

+1 on this