Yes, OAuth2.0 Plugin only allows HTTPS or HTTP if HTTPS was terminated and there was X-Forwarded-Proto (added by a trusted source or you trust all sources, e.g. added by the client) with value of https added.

Please review the following codes,maybe you can fix it so easy!
--- Checks whether a request is https or was originally https (but already -- terminated). It will check in the current request (globalngxtable). If -- the headerX-Forwarded-Protoexists -- with valuehttpsthen it will also -- be considered as an https connection. -- @param trusted_ip boolean indicating if the client is a trusted IP -- @param allow_terminated if truthy, theX-Forwarded-Proto` header will be checked as well.
-- @return boolean or nil+error in case the header exists multiple times
_M.check_https = function(trusted_ip, allow_terminated)
if ngx.var.scheme:lower() == "https" then
return true
end

if not allow_terminated then
return false
end

-- if we trust this IP, examine it's X-Forwarded-Proto header
-- otherwise, we fall back to relying on the client scheme
-- (which was either validated earlier, or we fall through this block)
if trusted_ip then
local scheme = ngx.req.get_headers()["x-forwarded-proto"]

-- we could use the first entry (lower security), or check the contents of
-- each of them (slow). So for now defensive, and error
-- out on multiple entries for the x-forwarded-proto header.
if type(scheme) == "table" then
  return nil, "Only one X-Forwarded-Proto header allowed"
end

return tostring(scheme):lower() == "https"

end

return false
end

`

I'd like to fix this issue, I'll be grateful for any further tips on where to start.

Thanks!

Friendly /cc @bungle

@scorphus Have you fixed this issue?

@abimarank still finding my way around it. Do you have any tips?

/cc @thibaultcha 🙂

1.While using docker we have the option to choose from https and http when creating an instance using an image in a container this will remove the error.
2. Not Using nginx proxy server will remove this error becaue it work only with http response
3. Graphql API should be used on the client side.