Mattermost with Gitlab SSO ignores https scheme when creating implicit token request

I’m glad you found that useful. Now I just wish I could get my own instance working! I think you are right that Mattermost needs to forward to the correct URL’s, but I’m not sure this needs to be a configuration item. I think it should probably detect this in the headers coming from the browser or just use protocol-less redirects to avoid having to know at all.

In the mean time you can probably correct for this error in your front end. Instead of hosting an HTTP version to catch that one page load, redirect that traffic to where it belongs. I use a catch-all HTTP vhost that then has a list of domains that should be HTTPS only and shunts any confused traffic off to where it belongs:

RewriteCond %{HTTP_HOST} ^(gitlab|mattermost).alerque.com$ [NC,OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R=301]
1 Like