From d62596abcc5502126d5aec7337f85347f8e0596b Mon Sep 17 00:00:00 2001
From: Nathan FONTEYNE <nathan.fonteyne@axians.com>
Date: Wed, 8 Jul 2026 13:56:34 +0200
Subject: [PATCH] fix: requete http cause error

---
 src/auth/oidc.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/auth/oidc.js b/src/auth/oidc.js
index fd5fd8d..43c0af1 100644
--- a/src/auth/oidc.js
+++ b/src/auth/oidc.js
@@ -4,10 +4,19 @@ const config = require('../config');
 let oidcConfig = null;
 
 async function initOidc() {
+  const issuerUrl = new URL(config.authentikIssuerUrl);
+  // Talking to Authentik over its internal Docker hostname (http://) rather
+  // than its public HTTPS URL is expected (avoids a round trip through
+  // Traefik) — openid-client refuses plain HTTP by default, so opt back in
+  // for that case. The flag persists on the resulting Configuration for all
+  // later calls (token exchange, etc.), not just discovery.
+  const options = issuerUrl.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
   oidcConfig = await client.discovery(
-    new URL(config.authentikIssuerUrl),
+    issuerUrl,
     config.oidcClientId,
-    config.oidcClientSecret
+    config.oidcClientSecret,
+    undefined,
+    options
   );
   return oidcConfig;
 }