Error "Redirect URL is invalid: URL must use https" when registering OAuth application in Bitbucket Server about git-credential-manager HOT 6 OPEN

FWIW the OAuth spec recommends to use https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 recommends to use 127.0.0.1 instead of localhost:

While redirect URIs using localhost (i.e., "http://localhost:{port}/{path}") function similarly to loopback IP redirects described in Section 7.3, the use of localhost is NOT RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather than localhost avoids inadvertently listening on network interfaces other than the loopback interface. It is also less susceptible to client-side firewalls and misconfigured host name resolution on the user's device.

And the server should allow any port to match loopback redirect URIs:

The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request.

from git-credential-manager.

@mminns Can you reproduce this?

from git-credential-manager.

You should be able to disable that check using a system property, e.g.

-Datlassian.oauth2.provider.skip.redirect.url.https.requirement=true

Looks like that is missing from the documentation

from git-credential-manager.

// Check if an entry already exists in the keychain
int findResult = SecKeychainFindGenericPassword(
IntPtr.Zero, serviceNameLength, serviceName, accountLength, account,
out uint passwordDataLength, out passwordData, out itemRef);

switch (findResult)
{
// Update existing entry only if the password/secret is different
case OK when !InteropUtils.AreEqual(secretBytes, passwordData, passwordDataLength):
ThrowIfError(
SecKeychainItemModifyAttributesAndData(itemRef, IntPtr.Zero, (uint) secretBytes.Length, secretBytes),
"Could not update existing item"
);
break;

from git-credential-manager.