Its possible to make the "Redirect URI" editable?

[EnricoVogt]

Is it possible to make the Redirect URI field editable on the "Social Sign-in" page in the ory-cloud interface?

Background:

• I have an running instance of kratos in the ory cloud.
• I have kratos-selfservice-ui-node running on localhost
• I have ory proxy running on localhost.
• kratos-selfservice-ui-node using the ory proxy to connect to kratos in the cloud (apiBaseUrl=http://localhost:4000/.ory)
• With my browser i access the UI through the ory proxy (http://localhost:4000/)

The default login flow works, but when i try to use SocialLogin with GitHub i get:

Unable to complete OpenID Connect flow because the OpenID Provider returned error "redirect_uri_mismatch": The redirect_uri MUST match the registered callback URL for this application.

I get this because i set the callback URL on github to: http://localhost:4000/.ory/self-service/methods/oidc/callback/github
while kratos asking github with:
github.com/login/oauth/authorize?client_id=XXX&redirect_uri=https://MYSLUG.projects.oryapis.com/self-service/methods/oidc/callback/github&response_type=code&scope=user&state=STATE

My assumption is that i need to configure the Redirect URI in the Social Sign-in strategy.

If i set callback URL on github to: https://MYSLUG.projects.oryapis.com/self-service/methods/oidc/callback/github as described in the ory cloud interface, then i get the following error:
{ "code": 400, "debug": "key ory_kratos_oidc_auth_code_session does not exist in cookie: ory_kratos_continuity\ngithub.com/ory/kratos/x.SessionGetString.func1\n\t/go/pkg/mod/github.com/ory/[email protected]/x/cookie.go:27\ngithub.com/ory/kratos/x.SessionGetString\n\t/go/pkg/mod/github.com/ory/[email protected]/x/cookie.go:46\ngithub.com/ory/kratos/continuity.(*ManagerCookie).sid\n\t/go/pkg/mod/github.com/ory/[email protected]/continuity/manager_cookie.go:97\ngithub.com/ory/kratos/continuity.(*ManagerCookie).container\n\t/go/pkg/mod/github.com/ory/[email protected]/continuity/manager_cookie.go:109\ngithub.com/ory/kratos/continuity.(*ManagerCookie).Continue\n\t/go/pkg/mod/github.com/ory/[email protected]/continuity/manager_cookie.go:64\ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).validateCallback\n\t/go/pkg/mod/github.com/ory/[email protected]/selfservice/strategy/oidc/strategy.go:254\ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).handleCallback\n\t/go/pkg/mod/github.com/ory/[email protected]/selfservice/strategy/oidc/strategy.go:298\ngithub.com/ory/kratos/selfservice/strategy.disabledWriter\n\t/go/pkg/mod/github.com/ory/[email protected]/selfservice/strategy/handler.go:25\ngithub.com/ory/kratos/selfservice/strategy.IsDisabled.func1\n\t/go/pkg/mod/github.com/ory/[email protected]/selfservice/strategy/handler.go:30\ngithub.com/ory/kratos/x.NoCacheHandle.func1\n\t/go/pkg/mod/github.com/ory/[email protected]/x/nocache.go:18\ngithub.com/ory/kratos/x.NoCacheHandle.func1\n\t/go/pkg/mod/github.com/ory/[email protected]/x/nocache.go:18\ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP\n\t/go/pkg/mod/github.com/julienschmidt/[email protected]/router.go:387\ngithub.com/ory/nosurf.(*CSRFHandler).handleSuccess\n\t/go/pkg/mod/github.com/ory/[email protected]/handler.go:212\ngithub.com/ory/nosurf.(*CSRFHandler).ServeHTTP\n\t/go/pkg/mod/github.com/ory/[email protected]/handler.go:169\ngithub.com/urfave/negroni.Wrap.func1\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:46\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/ory/kratos/x.glob..func1\n\t/go/pkg/mod/github.com/ory/[email protected]/x/clean_url.go:12\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1\n\t/go/pkg/mod/github.com/prometheus/[email protected]/prometheus/promhttp/instrument_server.go:239\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1\n\t/go/pkg/mod/github.com/prometheus/[email protected]/prometheus/promhttp/instrument_server.go:117\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func1\n\t/go/pkg/mod/github.com/prometheus/[email protected]/prometheus/promhttp/instrument_server.go:76\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func2\n\t/go/pkg/mod/github.com/prometheus/[email protected]/prometheus/promhttp/instrument_server.go:84\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerRequestSize.func1\n\t/go/pkg/mod/github.com/prometheus/[email protected]/prometheus/promhttp/instrument_server.go:197\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2047\ngithub.com/ory/x/prometheusx.Metrics.instrumentHandlerStatusBucket.func1\n\t/go/pkg/mod/github.com/ory/[email protected]/prometheusx/metrics.go:108", "message": "no resumable session found", "reason": "The browser does not contain the necessary cookie to resume the session. This is a security violation and was blocked. Please clear your browser's cookies and cache and try again!", "status": "Bad Request" }

[aeneasr]

Hey @EnricoVogt :) Thank you for the question! This is currently indeed not easily configurable. The biggest problem is also that GitHub only allows one redirect URL per client.

My recommendation would be - for testing - to set up another Social Sign In provider with GitHub and a new GitHub client with the Redirect URL of http://localhost:4000/.ory/self-service/methods/oidc/callback/github and name it e.g. GitHub Local.

We're working on resolving this issues with a better approach though, but we're not 100% there yet :)

[EnricoVogt]

Hey @aeneasr , maybe i misunderstood, but even if i create another "github local" provider im not able to set this value, because the field is disabled in the ory-cloud interface (Screenshot: https://imgur.com/a/0oghcu9).

I set correct redirect URL on Github-Site (Authorization callback URL=http://localhost:4000/.ory/self-service/methods/oidc/callback/github), but Kratos still asking with its default host:
Screenshot: https://imgur.com/a/hOlFBal

[aeneasr]

Oh yeah, you’re absolutely right! The UI is a bit misleading here, if you use the proxy or tunnel, or the node integration package the correct URL should be injected. I will try that out tomorrow and let you know :)