[openstreetmap/openstreetmap-website] Third party login fails on api.openstreetmap.org (Issue #7338)

[Kendell]

KTibow created an issue (openstreetmap/openstreetmap-website#7338)

### URL

https://api.openstreetmap.org/login

### How to reproduce the issue?

1. Open https://api.openstreetmap.org/login
2. Notice that you stay on api.openstreetmap.org instead of being redirected to www.openstreetmap.org
3. Notice that 4/6 options are broken:
    - Google = "Error 400: redirect_uri_mismatch"
    - Apple = "invalid_request"
    - GitHub = "The redirect_uri is not associated with this application."
    - Wikipedia = "Redirecting to ..."

### Screenshot(s) or anything else?

The vhost serves both hosts from one Rails app, but is *supposed* to redirect non-api `api.` requests to `www.`, but isn't in prod:

https://github.com/openstreetmap/chef/blob/869a95e80595c2ec6d25a08dd6680484d214fda3/cookbooks/web/templates/default/apache.frontend.erb#L18-L19

https://github.com/openstreetmap/chef/blob/869a95e80595c2ec6d25a08dd6680484d214fda3/cookbooks/web/templates/default/apache.frontend.erb#L261-L266

Provider buttons are relative links, so the callback follows the request host, which [stopped working on GitHub recently](https://github.blog/changelog/2026-08-14-multiple-redirect-uris-and-token-refresh-for-oauth-apps/):

https://github.com/openstreetmap/openstreetmap-website/blob/9da0fa5ecbff8adc5e6e91c7cf22546755a91f77/app/views/application/_auth_button.html.erb#L3-L6

https://github.com/openstreetmap/openstreetmap-website/blob/9da0fa5ecbff8adc5e6e91c7cf22546755a91f77/config/initializers/omniauth.rb#L3-L12


-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/7338
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/7338 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260822/41f7743c/attachment.htm>