Support for Custom URI Schemes in OAuth2 Redirect URIs for Mobile App Integration #14440

New Issue

GiteaMirror · 2025-11-02T11:13:01-06:00

GiteaMirror commented

2025-11-02 11:13:01 -06:00

Originally created by @TwentyFiveSoftware on GitHub (May 2, 2025).

Description

Hi,

I'm trying to use Gitea as an OAuth provider for a Flutter mobile app, but I ran into a problem when setting up an OAuth2 Application. I want to use a redirect URI with custom scheme like com.example.example_app://callback, as this is a standard way to handle OAuth callbacks in mobile apps (i.e. as recommended in the flutter_appauth package documentation).

Unfortunately, Gitea doesn't seem to allow redirect URIs unless they start with http/https. That makes it hard to use Gitea with mobile apps that rely on custom schemes to handle OAuth callbacks. Other major OAuth providers like GitHub and GitLab do allow custom schemes, so I was surprised this isn't permitted in Gitea.

I found some Gitea integration tests related to the redirect URI validation, so I’m wondering if this was an intentional decision? Or maybe just an oversight?

It would be great if Gitea could support custom URI schemes for the OAuth redirect URIs.

Gitea Version

1.25.0+dev-9-gcbb2e52911 (current Gitea demo site version)

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

https://demo.gitea.com/

Database

None

Originally created by @TwentyFiveSoftware on GitHub (May 2, 2025). ### Description Hi, I'm trying to use Gitea as an OAuth provider for a Flutter mobile app, but I ran into a problem when setting up an OAuth2 Application. I want to use a redirect URI with custom scheme like `com.example.example_app://callback`, as this is a standard way to handle OAuth callbacks in mobile apps (i.e. as recommended in the [flutter_appauth package documentation](https://pub.dev/packages/flutter_appauth#android-setup)). Unfortunately, Gitea doesn't seem to allow redirect URIs unless they start with `http`/`https`. That makes it hard to use Gitea with mobile apps that rely on custom schemes to handle OAuth callbacks. Other major OAuth providers like GitHub and GitLab do allow custom schemes, so I was surprised this isn't permitted in Gitea. I found some [Gitea integration tests](https://github.com/go-gitea/gitea/blob/cbb2e529117f7900e20deabb32bdf661564715f0/tests/integration/user_settings_test.go#L328) related to the redirect URI validation, so I’m wondering if this was an intentional decision? Or maybe just an oversight? It would be great if Gitea could support custom URI schemes for the OAuth redirect URIs. ### Gitea Version 1.25.0+dev-9-gcbb2e52911 (current Gitea demo site version) ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? https://demo.gitea.com/ ### Database None

GiteaMirror added the type/bug label 2025-11-02 11:13:01 -06:00

GiteaMirror commented

2025-11-02 11:13:02 -06:00

@mikepharesjr commented on GitHub (Jul 25, 2025):

Immich also relies on this for mobile apps

@mikepharesjr commented on GitHub (Jul 25, 2025): Immich also relies on this for mobile apps

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14440