title: Invalid Redirect: You are using a sensitive scope. URI must use https:// as the scheme
body: <p>when I log into my app, I get a message</p>
  <blockquote>
  <p>If you’re the app developer, make sure that these request details
  comply with Google policies. redirect_uri:
  http://XXXXXX/login/oauth2/code/google</p>
  </blockquote>
  <p>I tried to add this to the Authorized redirect URIs in my google cloud
  but I get an error</p>
  <blockquote>
  <p>Invalid Redirect: You are using a sensitive scope. URI must use
  https:// as the scheme</p>
  </blockquote>
  <p><a href="https://i.stack.imgur.com/qizI2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qizI2.png" alt="enter image description here" /></a></p>
  <p>also if I add a url with</p>
  <blockquote>
  <p>https://</p>
  </blockquote>
  <p>then I still get a message when I log into the app</p>
  <blockquote>
  <p>If you’re the app developer, make sure that these request details
  comply with Google policies. redirect_uri:
  http://XXXXXXX/login/oauth2/code/google</p>
  </blockquote>
  <p>my technology stack:
  java
  spring
  vaadin</p>
  <p>properties file:</p>
  <pre><code>server.port=${PORT:8080}
  spring.security.oauth2.client.registration.google.client-id=xxxxxx.apps.googleusercontent.com
  spring.security.oauth2.client.registration.google.client-secret=xxxxxx
  spring.security.oauth2.client.registration.google.scope=openid,email,profile,\
    https://www.googleapis.com/auth/spreadsheets,\
    https://www.googleapis.com/auth/spreadsheets.readonly,\
    https://www.googleapis.com/auth/drive.file,\
    https://www.googleapis.com/auth/drive,\
    https://www.googleapis.com/auth/script.scriptapp
  spring.security.oauth2.client.provider.google.token-uri=https://oauth2.googleapis.com/token
  spring.security.oauth2.client.provider.google.authorization-uri=https://accounts.google.com/o/oauth2/auth?prompt=consent&amp;access_type=offline
  spring.security.oauth2.client.provider.google.user-info-uri=https://www.googleapis.com/oauth2/v3/userinfo
  </code></pre>
  <p>the code that gets Credential:</p>
  <pre><code>public void initCredential(OAuth2AuthorizedClientService authorizedClientService, Authentication authentication ) {
        OAuth2AuthorizedClient authorizedClient = authorizedClientService.loadAuthorizedClient(
            &quot;google&quot;,
            authentication.getName());
        credential = new GoogleCredential.Builder()
            .setClientSecrets(CLIENT_ID,CLIENT_SECRET)
            .setJsonFactory(GsonFactory.getDefaultInstance())
       .setTransport(GoogleNetHttpTransport.newTrustedTransport())
            .build()
            .setAccessToken(authorizedClient.getAccessToken().getTokenValue())
            .setRefreshToken(authorizedClient.getRefreshToken().getTokenValue());
    }
  </code></pre>
  <p>also Oauth2 configuration:</p>
  <pre><code>@EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends VaadinWebSecurityConfigurerAdapter {
  
    private static final String LOGIN_URL = &quot;/login&quot;;
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      super.configure(http);
      http.oauth2Login()
          .loginPage(LOGIN_URL).permitAll();
    }
  
    @Override
    public void configure(WebSecurity web) throws Exception {
      super.configure(web);
      web.ignoring().antMatchers(
              &quot;/VAADIN/**&quot;,
              &quot;/favicon.ico&quot;,
              &quot;/robots.txt&quot;,
              &quot;/manifest.webmanifest&quot;,
              &quot;/sw.js&quot;,
              &quot;/offline-page.html&quot;,
              &quot;/frontend/**&quot;,
              &quot;/webjars/**&quot;,
              &quot;/frontend-es5/**&quot;, &quot;/frontend-es6/**&quot;)
          .antMatchers(HttpMethod.POST, &quot;/notifications&quot;);
    }
  }
  </code></pre>
  <p>as I understand it, I need to configure the use of the https protocol in the configuration, but I don't understand a little where I can configure it</p>
  <p>it is also worth noting that the application works locally, but when deploying it to AWS and trying to login via oauth 2, I get the message</p>