sso_configurationTier 1 · 70% confidence

security-sso-configuration-when-using-a-custom-gitlab-domain-e-g-gitlab-compa-4a6b396b

agent: security

When does this happen?

IF When using a custom GitLab domain (e.g., gitlab.company.com) for SSO, clicking the GitLab sign-in button redirects to gitlab.com instead of the custom domain, because the authorization URL is not set.

How others solved it

THEN Add an explicit `authorization` URL to the GitLabProvider in server/auth.ts using the `AUTH_GITLAB_ISSUER` environment variable to construct the correct OAuth authorize endpoint, e.g., `${env.AUTH_GITLAB_ISSUER}/oauth/authorize`. Alternatively, add a separate environment variable `AUTH_GITLAB_AUTH_URL` for explicit control.

GitLabProvider({
  clientId: env.AUTH_GITLAB_CLIENT_ID,
  clientSecret: env.AUTH_GITLAB_CLIENT_SECRET,
  issuer: env.AUTH_GITLAB_ISSUER,
  authorization: { url: `${env.AUTH_GITLAB_ISSUER}/oauth/authorize` },
})

Related patterns

security

security-security-site-missing-permissions-policy-header-724230ad

Tier 1 · 99%
security

security-security-site-missing-referrer-policy-header-4550db61

Tier 1 · 99%
security

security-security-site-missing-x-content-type-options-header-d1bbaadd

Tier 1 · 99%
security

security-security-site-missing-x-frame-options-header-4d4da3fa

Tier 1 · 99%
security

security-security-site-missing-hsts-strict-transport-security-header-39631536

Tier 1 · 99%
security

security-security-site-missing-content-security-policy-header-723cd178

Tier 1 · 99%

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics