When attempting to log in, the error message "Invalid redirect URI" is displayed.
This issue occurs only when accessing via the Angular UI (/aui) and Foglight is behind a proxy or load balancer; the Classic Console (/console) is not affected.
The following message is present in the Foglight Management Server (FMS) logs:
WARN [http-exec-4] com.quest.foglight.auth.util.ServletUtils - isValidRedirect suspect as vulnerable redirect=https://foglight.yourdomain.com/aui/auth
When debug logging is enabled, the following message is included in the logs:
DEBUG [http-exec-2] com.quest.foglight.auth.util.ServletUtils - ServletUtils::isValidRedirect url=http://foglight.yourdomain.com/login/page uri=/login/page redirect=https://foglight.yourdomain/aui/auth address=http://foglight.yourdomain.com
This may happen due to security enhancements introduced in Foglight 7.3.0 (FOG-9149), which affect certain proxy or load balancer configurations.
It can occur when a client connects to the proxy via HTTPS, while the proxy or load balancer connects to Foglight over HTTP and the "X-Forwarded-Proto" header is not included to identify the protocol the client used to connect to the proxy or load balancer.
WORKAROUND 1 (recommended)
Review the proxy or load balancer configuration to ensure it includes the "X-Forwarded-Proto" header to identify the client's connection protocol (HTTPS).
Note: The configuration steps may vary depending on the proxy or load balancer in use. Consult system administrators for configuration guidance.
WORKAROUND 2
Change the default value of the of registry variable "oauth.cors.allowed.origins" to the one of the URL used to access Foglight:
Note: Updating the registry variable to a specific URL would allow the validation to pass and for that URL to be the single allowed origin.
