External URL?

[whoiswes]

Hi all,

Been working on moving some of our old apps from Flask to Starlite. I've run into the first issue I haven't been able to solve, and it's related to external URL management, specifically around generating the redirect URL for authlib. I've ported the Starlette plugin to work with Starlite, but can't get URL management sorted.

With Flask, I can use url = url_for(".openid_sso", _external=True, _scheme="https") and that will resolve the fully qualified domain name. Then that gets passed to my OIDC provider and all is well. As long as the URI I'm hitting in the browser is correct, Flask is introspecting that and generating the proper FQDN.

With Starlite, even passing the "host" parameter to uvicorn, request.url_for is always returning localhost:8001/{path-goes-here}. Keep in mind, I can't just sit behind nginx in this case as the URL is being generated dynamically within my login route. I suppose I might be able to parse request headers and generate a URL that way, but that seems like a hack.

I'm probably missing something obvious but I've been reading docs for a good hour and haven't made any progress.

Thanks in advance.

EDIT: I should have RTFM'd more. Adding notes in case anyone else stumbles across this later.

The issue was with my nginx configuration. I needed to add the proxy configuration as defined here: https://www.uvicorn.org/deployment/#running-behind-nginx

That did the trick and I'm now able to fully authenticate via OIDC with authlib.

[JacobCoffee]

The issue was with my nginx configuration. I needed to add the proxy configuration as defined here: https://www.uvicorn.org/deployment/#running-behind-nginx

was the answer here

[whoiswes]

For anyone else who runs into this, here's my config:

nginx -> uvicorn -> starlite

nginx virtual server config:

server {
    listen 443 ssl;
    server_name
        domain-goes-here.com
    ssl_certificate ssl/ssl.cer;
    ssl_certificate_key ssl/ssl.key;
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_redirect off;
        proxy_buffering off;
        proxy_pass http://127.0.0.1:8000/;
    }
}

uvicorn is just run on the CLI as follows:

uvicorn module.main:app --port 8000

Note that because of our OpenID provider, we have to use the fully qualified domain name as well as have a valid SSL cert, so I'm using my hosts file to redirect to localhost. I would assume the Host header is probably being picked up by Starlite to generate URLs (haven't checked the source to verify because I'm lazy).

Thanks!