Skip to content

Redirect from /swagger-ui.html to /swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config can lead to HTTPS downgrade #1100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
d3ns0n opened this issue Mar 9, 2021 · 0 comments · Fixed by #1104

Comments

@d3ns0n
Copy link
Contributor

d3ns0n commented Mar 9, 2021

Describe the bug
We are running a spring-boot application behind a load balancer that terminates HTTPS. When accessing https://my-application.url/swagger-ui.html it redirects to http://my-application.url/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config. This is caused by the fact that SwaggerWelcomeWebMvc#redirectToUi returns a String with redirect:
prefix. This causes the tomcat to return an absolute URL, using HTTP as protocol instead of HTTPS, in the HTTP location header.

To Reproduce
Steps to reproduce the behavior:

  • What version of spring-boot you are using: 2.4.1
  • What modules and versions of springdoc-openapi are you using: springdoc-openapi-ui, springdoc-openapi-data-rest

Expected behavior
The redirect respects the used protocol, in this case HTTPS. I guess a relative redirect could solve this problem.

Additional context
As a workaround you can either access https://my-application.url/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config directly or set server.tomcat.use-relative-redirects=true in your application.properties

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant