Nginx反向代理下Auth0重定向URI不匹配问题的解决咨询

1. 修正Nginx代理配置，传递真实请求头 #

默认Nginx转发请求时会将Host头替换为后端服务地址（localhost:9999），导致后端无法获取外部真实访问地址（localhost:8888）。需在Nginx配置中添加代理头，传递真实请求信息：

server {
    listen       8888;
    server_name  localhost;
      
    location = /login {
        # 传递真实Host头
        proxy_set_header Host $host:$server_port;
        # 传递真实客户端IP与协议
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_pass http://localhost:9999/login;
    }
}

2. 配置后端AuthenticationController识别代理地址 #

com.auth0的AuthenticationController默认基于请求的本地地址构建回调URL，需调整为识别反向代理传递的头信息，或直接指定固定回调地址：

方式一：用RequestWrapper适配代理头（Servlet环境） #

创建自定义请求包装类，从代理头中提取真实地址：

public class ForwardedRequestWrapper extends HttpServletRequestWrapper {
    private final String host;
    private final String scheme;

    public ForwardedRequestWrapper(HttpServletRequest request) {
        super(request);
        this.host = request.getHeader("X-Forwarded-Host") != null ? request.getHeader("X-Forwarded-Host") : request.getServerName() + ":" + request.getServerPort();
        this.scheme = request.getHeader("X-Forwarded-Proto") != null ? request.getHeader("X-Forwarded-Proto") : request.getScheme();
    }

    @Override
    public String getServerName() {
        return host.split(":")[0];
    }

    @Override
    public int getServerPort() {
        String[] hostParts = host.split(":");
        return hostParts.length == 2 ? Integer.parseInt(hostParts[1]) : ("https".equals(scheme) ? 443 : 80);
    }

    @Override
    public String getScheme() {
        return scheme;
    }
}

处理回调时用该类包装原始请求：

HttpServletRequest wrappedRequest = new ForwardedRequestWrapper(request);
Token token = authenticationController.handle(wrappedRequest, response);

方式二：直接指定固定redirect_uri #

若代理地址固定，可在生成授权URL和处理回调时明确指定回调地址：

// 生成授权URL
String authorizeUrl = authenticationController.buildAuthorizeUrl(request, response)
    .withRedirectUri("http://localhost:8888/login")
    .build();

// 处理回调
Token token = authenticationController.handle(request, response, "http://localhost:8888/login");

3. 验证Auth0应用配置 #

确保Auth0应用的允许的回调URL列表包含完整路径http://localhost:8888/login，避免因路径不匹配触发错误。

内容的提问来源于stack exchange，提问作者Ziaullhaq Savanur