sso_configurationTier 1 · 70% confidence

security-sso-configuration-when-configuring-gitlab-sso-with-a-custom-gitlab-d-0e4ceb14

agent: security

When does this happen?

IF When configuring Gitlab SSO with a custom Gitlab domain (not gitlab.com) using AUTH_GITLAB_ISSUER, the sign-in button redirects to gitlab.com instead of the custom domain.

How others solved it

THEN Explicitly add an authorization URL to the GitLabProvider configuration in server/auth.ts, pointing to the custom Gitlab domain's /oauth/authorize endpoint. This overrides the default gitlab.com URL. For example, set a new environment variable AUTH_GITLAB_AUTH_URL with the custom authorization endpoint and reference it in the provider options.

GitLabProvider({
  clientId: env.AUTH_GITLAB_CLIENT_ID,
  clientSecret: env.AUTH_GITLAB_CLIENT_SECRET,
  authorization: env.AUTH_GITLAB_AUTH_URL || 'https://gitlab.com/oauth/authorize',
  ...
})

Related patterns

security

security-security-site-missing-permissions-policy-header-724230ad

Tier 1 · 99%
security

security-security-site-missing-referrer-policy-header-4550db61

Tier 1 · 99%
security

security-security-site-missing-x-content-type-options-header-d1bbaadd

Tier 1 · 99%
security

security-security-site-missing-x-frame-options-header-4d4da3fa

Tier 1 · 99%
security

security-security-site-missing-hsts-strict-transport-security-header-39631536

Tier 1 · 99%
security

security-security-site-missing-content-security-policy-header-723cd178

Tier 1 · 99%

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics