Skip to content

Fix Cognito config + forwarded headers for correct HTTPS redirects #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WChunter21 merged 1 commit into from
Feb 18, 2026
Merged

Fix Cognito config + forwarded headers for correct HTTPS redirects #99

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ jobs:
Authentication__Cognito__ClientId=${{ secrets.COGNITO_CLIENT_ID }}
Authentication__Cognito__ClientSecret=${{ secrets.COGNITO_CLIENT_SECRET }}
Authentication__Cognito__Domain=${{ secrets.COGNITO_DOMAIN }}
Authentication__Cognito__UserPoolId=${{ secrets.COGNITO_USER_POOL_ID }}
AWS__Region=${{ env.AWS_REGION }}
EOF
sudo chown ${{ secrets.LIGHTSAIL_USER }}:${{ secrets.LIGHTSAIL_USER }} /var/www/culinarycommand/.env
sudo chmod 640 /var/www/culinarycommand/.env
Expand All @@ -145,6 +147,8 @@ jobs:
export Authentication__Cognito__ClientId="${{ secrets.COGNITO_CLIENT_ID }}"
export Authentication__Cognito__ClientSecret="${{ secrets.COGNITO_CLIENT_SECRET }}"
export Authentication__Cognito__Domain="${{ secrets.COGNITO_DOMAIN }}"
export Authentication__Cognito__UserPoolId="${{ secrets.COGNITO_USER_POOL_ID }}"
export AWS__Region="${{ env.AWS_REGION }}"
EOF
sudo chown ${{ secrets.LIGHTSAIL_USER }}:${{ secrets.LIGHTSAIL_USER }} /var/www/culinarycommand/.env.export
sudo chmod 640 /var/www/culinarycommand/.env.export
Expand Down
84 changes: 48 additions & 36 deletions CulinaryCommandApp/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,33 +45,49 @@
.AddCookie()
.AddOpenIdConnect(options =>
{
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
var userPoolId = "us-east-2_SULe0c9vr";
var region = "us-east-2";
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

// ---- Read Cognito config (env/appsettings) ----
var region =
builder.Configuration["AWS:Region"]
?? builder.Configuration["AWS_REGION"]
?? builder.Configuration["Authentication:Cognito:Region"]; // optional

var userPoolId = builder.Configuration["Authentication:Cognito:UserPoolId"];
var clientId = builder.Configuration["Authentication:Cognito:ClientId"];

// client secret can come from either config or a raw env var
var clientSecret =
Environment.GetEnvironmentVariable("COGNITO_CLIENT_SECRET")
?? builder.Configuration["Authentication:Cognito:ClientSecret"];

// Fail fast if missing (prevents weird half-working deploys)
if (string.IsNullOrWhiteSpace(region))
throw new InvalidOperationException("Missing config: AWS:Region (or AWS_REGION).");
if (string.IsNullOrWhiteSpace(userPoolId))
throw new InvalidOperationException("Missing config: Authentication:Cognito:UserPoolId");
if (string.IsNullOrWhiteSpace(clientId))
throw new InvalidOperationException("Missing config: Authentication:Cognito:ClientId");
if (string.IsNullOrWhiteSpace(clientSecret))
throw new InvalidOperationException("Missing config: Authentication:Cognito:ClientSecret (or COGNITO_CLIENT_SECRET).");

options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}";
options.MetadataAddress = $"{options.Authority}/.well-known/openid-configuration";

options.ClientId = "55joip0viah9qtj7dndhvma2gt";
var cognitoClientId = builder.Configuration["Authentication:Cognito:ClientId"];
var cognitoSecretFromEnv = Environment.GetEnvironmentVariable("COGNITO_CLIENT_SECRET");
var cognitoSecretFromConfig = builder.Configuration["Authentication:Cognito:ClientSecret"];

var cognitoClientSecret =
!string.IsNullOrWhiteSpace(cognitoSecretFromEnv) ? cognitoSecretFromEnv :
cognitoSecretFromConfig;

options.ClientId = cognitoClientId;
options.ClientSecret = cognitoClientSecret;

options.ClientId = clientId;
options.ClientSecret = clientSecret;

options.ResponseType = OpenIdConnectResponseType.Code;
options.SaveTokens = true;

options.CallbackPath = "/signin-oidc";
options.SignedOutCallbackPath = "/signout-callback-oidc";
// Use config if present, else default
options.CallbackPath =
builder.Configuration["Authentication:Cognito:CallbackPath"] ?? "/signin-oidc";

options.RequireHttpsMetadata = true; // keep true
options.SignedOutCallbackPath =
builder.Configuration["Authentication:Cognito:SignedOutCallbackPath"] ?? "/signout-callback-oidc";

options.RequireHttpsMetadata = true;

options.Scope.Clear();
options.Scope.Add("openid");
Expand All @@ -80,34 +96,25 @@

options.TokenValidationParameters.NameClaimType = "cognito:username";
options.TokenValidationParameters.RoleClaimType = "cognito:groups";
options.Events.OnRedirectToIdentityProvider = ctx =>
{
// Forces correct scheme/host behind nginx
ctx.ProtocolMessage.RedirectUri = $"{ctx.Request.Scheme}://{ctx.Request.Host}{options.CallbackPath}";
return Task.CompletedTask;
};

});

builder.Services.AddAuthorization();


//
// =====================
// AI Services
// =====================
builder.Services.AddSingleton<Client>(_ => new Client());
builder.Services.AddScoped<AIReportingService>();

// var googleKey =
// Environment.GetEnvironmentVariable("GOOGLE_API_KEY")
// ?? builder.Configuration["Google:ApiKey"]; // optional appsettings slot

// if (!string.IsNullOrWhiteSpace(googleKey))
// {
// builder.Services.AddSingleton(_ => new Google.GenAI.Client(apiKey: googleKey));
// builder.Services.AddScoped<AIReportingService>();
// Console.WriteLine("✅ AI enabled (GOOGLE_API_KEY found).");
// }
// else
// {
// Console.WriteLine("⚠️ GOOGLE_API_KEY not set; AI features disabled.");
// // Do NOT register AIReportingService at all.
// }


//
// =====================
// Database
Expand Down Expand Up @@ -159,12 +166,17 @@

builder.Services.Configure<ForwardedHeadersOptions>(o =>
{
o.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
o.ForwardedHeaders =
ForwardedHeaders.XForwardedFor |
ForwardedHeaders.XForwardedProto |
ForwardedHeaders.XForwardedHost;

o.KnownNetworks.Clear();
o.KnownProxies.Clear();
});



//
// =====================
// Build App
Expand Down
Loading