Repository navigation
Bug: SSO sending incorrect localhost callback URL to OpenID provider #450
Description
v0.9.2. Despite the UI showing the correct callback URL for copy/paste, the actual one pushed through the SSO provider ends up being localhost. The vars and base URL are set correctly.
SSO Config
Rejected auth attempt
URLs
- Should be:
https://windshift.example.ca/api/sso/callback/myid - Windshift is redirecting:
http://localhost:8080/api/sso/callback/myid
Compose env
environment:
BASE_URL: https://windshift.example.ca
USE_PROXY: true
ALLOWED_HOSTS: '*.example.ca'
SSO_SECRET: xxx
SESSION_IP_BINDING: ${SESSION_IP_BINDING:-log}
WEBAUTHN_RP_ID: windshift.example.ca
TLS_SKIP_VERIFY: ${TLS_SKIP_VERIFY:-false}
WINDSHIFT_MEMORY_LIMIT_MB: ${WINDSHIFT_MEMORY_LIMIT_MB:-2048}
DB_PATH: /data/windshift.db
ATTACHMENT_PATH: /data/attachments
Activity
stefan-ernst commentedon Nov 4, 2026
hey @mitchplze - It looks like BASE_URL could silently not be passed to the container. Can you check docker exec printenv BASE_URL and see if there is a BASE_URL error in the logs? I will force the UI to report this correctly
fix(sso): show the server's real callback URL and warn when BASE_URL …
mitchplze commentedon Nov 4, 2026
Not sure how to check the var, it says there is no bash or sh available in the container.
stefan-ernst commentedon Nov 4, 2026
can you try the 0.9.3 image? it should surface the issue in the UI if the baseUrl is unknown
mitchplze commentedon Nov 4, 2026
Working.
I think you were right - I think the issue was with how I was setting the env var on my PaaS. Sorry for the confusion.
The helper yellow warning message is quite helpful, thanks!
stefan-ernst commentedon Nov 4, 2026
Nice! Which PaaS are you using? I am looking into publishing more templates (currently only Dokploy)
Its good we expose the baseUrl to the frontend now in any case because that allows for more validations like this. Thanks for reporting it
mitchplze commentedon Nov 4, 2026
I'm currently obsessed with Coolify actually, after trying (literally every other PaaS in existence).
It's one of the only actual FOSS ones, with no paid tier for self-hosting. It does so much across so many servers, in a really clever way. I really enjoy the integration of Traefik, the SSH baseline connection, and just how easy it is to do IaaC with it, and CI/CD deployments.
My Compose simply looks like this. Automatic secrets and URLs :) I'm sure they'd take a PR for a template!
stefan-ernst commentedon Nov 4, 2026
Thanks for the info!
Yeah I am waiting for 1000 stars to submit one (https://coolify.io/docs/contribute/service#adding-a-new-service-template-to-coolify requires it). Hopefully they will re-open PRs