# Keycloak "auth\_callback URL is served over http instead of https

**URL:** <https://forum.keycloak.org/t/keycloak-auth-callback-url-is-served-over-http-instead-of-https/6133>\
**Category:** Securing applications\
**Created:** [November 26, 2020, 2:32pm UTC](https://forum.keycloak.org/t/keycloak-auth-callback-url-is-served-over-http-instead-of-https/6133 "2020-11-26T14:32:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![lauren](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@lauren](https://forum.keycloak.org/u/lauren)\
**Post date:** [November 26, 2020, 2:32pm UTC](https://forum.keycloak.org/t/keycloak-auth-callback-url-is-served-over-http-instead-of-https/6133/1 "2020-11-26T14:32:32Z")

</div>

Good day

We are struggling at the moment. A protected resource loaded inside iframe is blocked by mixed active content because the auth\_callback URL is served over http instead of https.

Our current flow is:  
Protected application  
Apache reverse proxy -\> nodejs application with openid Keycloak  
Nginx reverse proxy -\> Keycloak Docker container

We do not know what part of these flows are throwing away the SSL. Can anyone please help or advise?