title: Redirect URI sent as HTTP and not HTTPS in app running HTTPS
body: <p>I have an Asp .net core MVC app.  Which connects to an Identity Server 4 for authentication.   Hosted in a docker swarm</p>
  
  <p>MVC app is hosted on <a href="https://XXXXXXX" rel="noreferrer">https://XXXXXXX</a>  </p>
  
  <p>ConfigurServies</p>
  
  <pre><code>services.AddAuthentication(options =&gt;
          {
              options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
          })
               .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
              .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =&gt;
              {
                  //options.DataProtectionProvider = DataProtectionProvider.Create(new DirectoryInfo(@"C:\temp-keys\"));
                  // when the identity has been created from the data we receive,
                  // persist it with this authentication scheme, hence in a cookie
                  options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  // Identity server endpoint
                  options.Authority = settingsSetup.IdentityServerEndpoint;
  
                  // Client id to login with
                  options.ClientId = settingsSetup.ClientId;
                  // Client secret.
                  options.ClientSecret = settingsSetup.Secret;
  
                  // Scope of our API
                  options.Scope.Add("testapi");
                  options.Scope.Add("devconsole");
                  // adding offline_access to get a refresh token
                  options.Scope.Add("offline_access");
  
                  options.ResponseType = "code id_token";
                  options.SaveTokens = true;
                  options.GetClaimsFromUserInfoEndpoint = true;
              });
  </code></pre>
  
  <p>When I try to run the app I get a redirect uri miss match error.</p>
  
  <pre><code>Invalid redirect_uri: http://developerconsole.XXXXX.io/signin-oidc
  {
    "ClientId": "BB1D2DA8-D7E4-4AF5-94FA-19EAD6B7D711.apps.XXXXX.biz",
    "ClientName": "Developer Console",
    "AllowedRedirectUris": [
      "http://localhost:55000/signin-oidc",
      "http://localhost:55000/auth.html",
      "http://localhost:55000/auth-silent.html"
      "https://developerconsole.XXXXX.io/signin-oidc"
    ],
    "SubjectId": "21379983",
    "RequestedScopes": "",
    "Raw": {
      "client_id": "BB1D2DA8-D7E4-4AF5-94FA-19EAD6B7D711.apps.XXXXX.biz",
      "redirect_uri": "http://developerconsole.XXXXX.io/signin-oidc",
      "response_type": "code id_token",
      "scope": "openid profile testapi devconsole offline_access",
      "response_mode": "form_post",
      "nonce": "636625889658410682.MjNlMmQwNjgtZmY0MC00MmVkLWFiNmMtN2M2YmQ5YTM5ZTQ3NjFiYzI2ZjktZWM0Yi00NDk3LTk1ZWMtNjJkYjViMDYwMTJm",
      "state": "CfDJ8Pwa8A3ipXlKtuyxNMpMxAz5QUFmdSunRKdlKS9sS390AKp8gIUZShQUMMCkFAhYLytitgsXUBgwlQDJaJvtHFqzHygLCPwS8Jab6IJzhpry90qS51E1y_eRlppamRDOzYDZ6fcDFzWV1U43BTP2B6pnPTSLNcZRaooyGBXtNokeUqOJ--u-_MOQB8Bw3n2cRyV4kisHNkslD1Gsi2wn1Cx6aTVlqzw_pxHelAXm1P8FyDJpD7G0azFgKgpQF0DRJtC5penRJQzHIHvQN8v4ECGeuSD1zlyfJYClLO2r6kY_R2OYqtBkV0r_SNc9h7xUYmnVaHKQzYqVc_mJO4iLLSMTZrBUICZWR8c4PZw0Os3N",
      "x-client-SKU": "ID_NET",
      "x-client-ver": "2.1.4.0"
    }
  }
  </code></pre>
  
  <p>The error is coming because i have         <code>"https://developerconsole.XXXXX.io/signin-oidc"</code> as a redirect uri and not         <code>"http://developerconsole.XXXXX.io/signin-oidc"</code>   I dont want to add HTTP redirect uris.  </p>
  
  <p>Why is my app building the redirect uri has http and not https?</p>
  
  <p>If i do add the HTTP on i am getting an annoying Correlation  error.  which i think is due to the fact that its being returned by the server as https since the server automatically converts http to https.</p>
  
  <blockquote>
    <p>An unhandled exception occurred while processing the request.
    Exception: Correlation failed.
    Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext()</p>
    
    <p>Stack Query Cookies Headers Exception: Correlation failed.
    Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext()
    System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
    System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
    task)
    Microsoft.AspNetCore.Authentication.AuthenticationMiddleware+d__6.MoveNext()
    System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
    System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
    task)
    Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware+d__7.MoveNext()</p>
  </blockquote>
  
  <p>I probably dont need to mention this works fine on localhost :/</p>