Use scheme from forwarded header if available.

lua/auth.lua

+local headers = ngx.req.get_headers()
 local returnTo = ngx.req.get_uri_args().ReturnTo
+local scheme = headers["x-forwarded-proto"]
+if not scheme then
+   scheme = ngx.var.scheme
+end
 if not returnTo then
-   returnTo = ngx.var.scheme .. '://' .. ngx.var.host .. '/'
+   returnTo = scheme .. '://' .. ngx.var.host .. '/'
 end
 local authServer = os.getenv('auth_server')
 local idp = os.getenv('idp')