Facebook Login HTTPS redirect uri

Facebook is recommending that I use a HTTPS redirect URL, instead of HTTP. I’ve been trying to find a way to configure it to generate a HTTPS URL, at the moment it’s generating a HTTPs URL.

https://www.facebook.com/v2.8/dialog/oauth?response_type=code&client_id=255162614498922&redirect_uri=http://example.com/signin-facebook&scope=&state=-x4AVtFysadfadsfsadROH6E1QJ82gv4e4j48s32K5xbmqlF-JFbE5Y2Tx_MAdSquCP6CjZjic8Ye6gwasdfdfask3PXWkyxS42Ajpks9IuumDOl6CUJsadfafsasfdasdfbfpEFUDyxJUR3fARlWc83Lysadffdsdaffsdafasdsdafx_ziTnttz

Currently it is generating: http://example.com/signin-facebook for the redirect_uri, but I’d like a HTTPS URL to redirect the user to.

Is there a way to configure it to generate a HTTPS URL?

This relates to packages Microsoft.Owin.Security and Microsoft.Owin.Security.Facebook.

Currently my OwinStart looks like this:

public class OwinStart
{
    public void Configuration(IAppBuilder app)
    {
            app.UseCookieAuthentication(new CookieAuthenticationOptions()
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Welcome")
            });

            app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            // Configure Facebook authentication
            app.UseFacebookAuthentication(new FacebookAuthenticationOptions
            {
                AppId = ConfigurationManager.AppSettings["FacebookAppId"],
                AppSecret = ConfigurationManager.AppSettings["FacebookAppSecret"]
            });
    }
}

Also, there doesn’t appear to be a way of Forcing HTTP within the FacebookAuthenticationOptions class or from the Challenge() method that instigates the redirect to Facebook:

internal class ChallengeResult : HttpUnauthorizedResult
{
    // TODO: Specify an XsrfKey?
    private const string XsrfKey = "SomethingHere";

    public ChallengeResult(string provider, string redirectUri)
        : this(provider, redirectUri, null)
    {
    }

    public ChallengeResult(string provider, string redirectUri, string userId)
    {
        this.LoginProvider = provider;
        this.RedirectUri = redirectUri;
        this.UserId = userId;
    }

    public string LoginProvider { get; set; }
    public string RedirectUri { get; set; }
    public string UserId { get; set; }

    public override void ExecuteResult(ControllerContext context)
    {
        var properties = new AuthenticationProperties { RedirectUri = this.RedirectUri };

        if (this.UserId != null)
        {
            properties.Dictionary[XsrfKey] = this.UserId;
        }

        context.HttpContext.GetOwinContext().Authentication.Challenge(properties, this.LoginProvider);
    }
}

[Tratcher]

No, you should keep the https redirect. To get FacebookAuth to generate the correct urls you should do read x-forwarded-scheme and set the request scheme. E.g.

app.Use((context, next) =>
{
  if (context.Request.Headers["x-forwarded-proto"] == "https")
  {
    context.Request.Scheme = "https";
  }
  return next();
});
// Use Cookies
// Use Facebook

[EdSF]

A key item in the above is that it is necessary do this if your application offloads SSL (to SSL concentrator/load balancer, etc) as stated in the SO answer

• The traffic between end user to your site is SSL (hits SSL concentrator/load balancer)
• The traffic between SSL concentrator/lb and your application is http
• therefore your application’s context is http

So your app must force it’s context to https without doing things like HttpRequest.IsSecureConnection or similar - that will never be true and results in a redirect loop.