title: airflow 1.10.10 behind Nginx Proxy: Oauth Redirect URL http instead of https
body: <p>I am deploying Airflow 1.10.10 on Kubernetes using the official Helm Chart (v.7.0.0) but I am running into issues with Oauth. </p>
  
  <p><strong>Here's my setup:</strong> </p>
  
  <ul>
  <li>Airflow Webserver with RBAC enabled. Airflow uses Flask Appabuilder in this case. </li>
  <li>Server runs behind an Nginx reverse proxy that does https termination. </li>
  <li>I try to authenticate against an Azure AD tenant using OAuth</li>
  </ul>
  
  <p><strong>my problem</strong>
  - When I try to login with the Microsoft account I get the error message "The reply URL specified in the request does not match the reply URLs configured for the application". 
  - The error is caused by Airflow setting the redirect URL to <a href="http://airflow.example.com/oauth_authorized/azure" rel="noreferrer">http://airflow.example.com/oauth_authorized/azure</a> instead of http<strong>S</strong>://airflow.example.com/oauhth_authorized/azure</p>
  
  <p><strong>what I think the issue is</strong></p>
  
  <p>Since nginx sends http requests to Flask, flask generates an http url for the redirect url instead of https. 
  So from what I understand, I need to find a way to tell Airflow/Flask that it should use https to generate the redirect URL instead. </p>
  
  <p><strong>What I tried:</strong></p>
  
  <p>I have two angles of attack: </p>
  
  <p><strong>1. setting the base URL to https explicitly in the webserver_config.py file</strong></p>
  
  <p>I tried putting environ['wsgi.url_scheme'] = 'https' in the config file, but I get a "environ is not defined" error. 
  Can I even set this in in the config.py file? What would I need to import for it to work?</p>
  
  <p><strong>2. Setting proxy headers in nginx</strong></p>
  
  <p>I tried to set multiple headers in Nginx using Kubernetes annotations, my current settings are: </p>
  
  <pre><code>        proxy_set_header   X-Forwarded-Proto    $scheme;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "Upgrade";
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Port $server_port;
  </code></pre>
  
  <p>I also tried to set </p>
  
  <pre><code>proxy_set_header Host $host;
  </code></pre>
  
  <p>but this leads to all traffic being redirected to a comma separated list of domains</p>
  
  <pre><code>airflow.example.com,airflow.example.com
  </code></pre>
  
  <p>which obviously does not work. </p>
  
  <p>I based these settings on the <a href="https://flask.palletsprojects.com/en/0.12.x/deploying/wsgi-standalone/#proxy-setups" rel="noreferrer">Flask documentation</a>.</p>
  
  <p>The rest of the Nginx config is the default of the official Nginx ingress controller I have running in my cluster. </p>
  
  <p>Does anybody have an idea what the issue could be? Are my two angles of attack valid or is there a third one that I am missing?</p>
  
  <p>Thanks a lot, any help is appreciated!</p>