I am trying to include a custom host:port in oauth2-proxy state to record the original domain to redirect to after authentication.

Here’s what works

Using an nginx server I’m successfully issuing a 302 redirct to:

oauth2/start?rd=https://whoami.braingeneers.gi.ucsc.edu/

That is translating into oauth2-proxy redirecting to my authentication provider and coming back with a state parameter

state=MhsGdHlnEhLgRahkhtLSVGlmZwmk8fMJCZo98K2zgUA%3Ahttps%3A%2F%2Fwhoami.braingeneers.gi.ucsc.edu%2F

At the end of that you see the domain whoami.braingeneers.gi.ucsc.edu%2F which successfully gets processed into a redirect back to the whoami web application.

All of that works.

Here’s where it fails

However, I need to redirect to a custom port 8443, however. If I modify my nginx config to redirect using:

oauth2/start?rd=https://whoami.braingeneers.gi.ucsc.edu:8443/

The state parameter being passed to my auth provider loses the domain, equivalently, when the redirect comes back from the auth provider.

The obvious answer is URL encoding, however I’ve tried everything I can think of, this also loses the state parameter:

oauth2/start?rd=https%3A%2F%2Fwhoami.braingeneers.gi.ucsc.edu%3A8443%2F

You may notice that the working example isn’t URL encoded, there’s an http:// unencoded that doesn’t break anything. But when I add :8443 oauth2-proxy fails to include the domain in the state parameter.

I’ve tried both --encode-state=true|false without a difference.

I’m just not sure how I should be encoding the request to /oauth2/start for oauth2-proxy to handle the port information.