Allow HTTP OAuth in recovery mode

2026-04-18 08:15:54 +02:00
parent 06663389a0
commit e6fbd189d6
2 changed files with 9 additions and 7 deletions
--- a/crates/http/src/auth/oauth/auth.rs
+++ b/crates/http/src/auth/oauth/auth.rs
@@ -170,9 +170,11 @@ impl OAuthApiHandler for Server {
                    .is_some_and(|uri| uri.starts_with("http://"))
                {
                    #[cfg(not(feature = "dev_mode"))]
-                    return Err(trc::AuthEvent::Error
-                        .into_err()
-                        .details("Redirect URI must be HTTPS."));
+                    if !self.registry().is_recovery_mode() {
+                        return Err(trc::AuthEvent::Error
+                            .into_err()
+                            .details("Redirect URI must be HTTPS."));
+                    }
                }

                // Parse and validate PKCE challenge (RFC 7636).