# OIDCXForwardedHeaders warnings in Open OnDemand 4.0.3
**URL:** https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261
**Category:** Get Help
**Tags:** question
**Created:** [May 20, 2025, 5:50pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261 "2025-05-20T17:50:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@jaguillette](https://discourse.openondemand.org/u/jaguillette)
#### Post date: [May 20, 2025, 5:50pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/1 "2025-05-20T17:50:30Z")
I’m in the process of updating our infrastructure from OOD 3 to OOD 4.0.3, and I’m finding that I’m getting a lot of warnings in our Apache logs like this:
```auto
oidc_check_x_forwarded_hdr: header X-Forwarded-Proto received but OIDCXForwardedHeaders not configured for it
oidc_check_x_forwarded_hdr: header X-Forwarded-Port received but OIDCXForwardedHeaders not configured for it
```
I’ve tried adding a configuration line to ood\_portal.yml to configure for those headers, like so:
```auto
oidc_settings:
OIDCXForwardedHeaders: X-Forwarded-Proto X-Forwarded-Port
```
But when I do that, I start getting “Bad request” errors when logging in to the OOD dashboard. A difference between requests that I’ve noticed is that our OIDC redirect uri started including the port after changing the oidc\_settings, so instead of `https://dev.ood.huit.harvard.edu/oidc` it’s `https://dev.ood.huit.harvard.edu:443/oidc`.
The ood\_portal.yml file looks like this (partially redacted):
```yml
servername: dev.ood.huit.harvard.edu
ssl:
- 'SSLCertificateFile "/etc/ssl/private/cert.crt"'
- 'SSLCertificateKeyFile "/etc/ssl/private/private_key.key"'
#oidc_settings:
# OIDCXForwardedHeaders: X-Forwarded-Proto X-Forwarded-Port
dex_uri: /dex
dex:
connectors:
- type: oidc
id: harvardkey
name: HarvardKey
config:
issuer: 'https://stage.pin1.harvard.edu/cas/oidc'
clientID: 'redacted'
clientSecret: 'redacted'
redirectURI: 'https://dev.ood.huit.harvard.edu/dex/callback'
scopes:
- openid
- email
- profile
getUserInfo: true
insecureSkipEmailVerified: true
userIDKey: sub
userNameKey: sub
# turn on proxy for interactive desktop apps
host_regex: '[^/]+'
node_uri: '/node'
rnode_uri: '/rnode'
user_map_cmd: '/etc/ood/add_user.sh'
```
We’ve also changed over from an Ubuntu operating system to Amazon Linux 3 in this switch, so that could be more of the issue than the version update.
Any insights would be much appreciated.
---
### Author:  [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)
#### Post date: [May 21, 2025, 6:45pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/2 "2025-05-21T18:45:31Z")
There is a ticket in github that these warnings are appearing but I haven’t gotten around to looking into it further, sorry.
---
### Author:  [@jaguillette](https://discourse.openondemand.org/u/jaguillette)
#### Post date: [May 22, 2025, 1:17pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/3 "2025-05-22T13:17:19Z")
I was able to get the warnings to go away with this config:
```yml
oidc_settings:
OIDCXForwardedHeaders: X-Forwarded-Proto X-Forwarded-Port
dex_uri: /dex
dex:
client_redirect_uris:
- 'https://dev.ood.huit.harvard.edu:443/oidc'
....
```
So adding the OIDCXForwardedHeaders setting was part of the solution, and adding a valid client\_redirect\_uri that includes the port got our setup to a better spot.
---
### Author:  [@swesters](https://discourse.openondemand.org/u/swesters)
#### Post date: [May 27, 2025, 3:36pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/4 "2025-05-27T15:36:20Z")
Good to hear that you managed to get rid of the warnings! Could you let us know which version of `mod_auth_openidc` that you are using, in case that matters?
---
### Author:  [@jaguillette](https://discourse.openondemand.org/u/jaguillette)
#### Post date: [May 28, 2025, 7:03pm UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/5 "2025-05-28T19:03:39Z")
The server is running `mod_auth_openidc` at version `2.4.15`.
---
### Author:  [@swesters](https://discourse.openondemand.org/u/swesters)
#### Post date: [August 27, 2025, 10:04am UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/6 "2025-08-27T10:04:20Z")
Hi all!
I asked upstream mod\_auth\_openidc to add an option to ignore the warnings, and they did.
Please see: [Is it possible to ignore OIDCXForwardedHeaders mismatch warnings? · OpenIDC/mod\_auth\_openidc · Discussion #1333 · GitHub](https://github.com/OpenIDC/mod_auth_openidc/discussions/1333)
The ignore feature was added in version 2.4.17.2 and can be activated by adding this into the `custom_vhost_directives` for your ood\_portal.conf:
```auto
SetEnvIfExpr true OIDC_CHECK_X_FORWARDED_HDR_LOG_DISABLE=X-Forwarded-Proto
```
This has decreased our log volume by around 30% from the OOD environments, so it’s definitely worth looking into.
---
### Author:  [@system](https://discourse.openondemand.org/u/system)
#### Post date: [February 23, 2026, 10:04am UTC](https://discourse.openondemand.org/t/oidcxforwardedheaders-warnings-in-open-ondemand-4-0-3/4261/7 "2026-02-23T10:04:42Z")
This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.