Skip to content

Redirect from /swagger-ui.html to /swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config can lead to HTTPS downgrade #1100

Closed
@d3ns0n

Description

@d3ns0n

Describe the bug
We are running a spring-boot application behind a load balancer that terminates HTTPS. When accessing https://my-application.url/swagger-ui.html it redirects to http://my-application.url/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config. This is caused by the fact that SwaggerWelcomeWebMvc#redirectToUi returns a String with redirect:
prefix. This causes the tomcat to return an absolute URL, using HTTP as protocol instead of HTTPS, in the HTTP location header.

To Reproduce
Steps to reproduce the behavior:

  • What version of spring-boot you are using: 2.4.1
  • What modules and versions of springdoc-openapi are you using: springdoc-openapi-ui, springdoc-openapi-data-rest

Expected behavior
The redirect respects the used protocol, in this case HTTPS. I guess a relative redirect could solve this problem.

Additional context
As a workaround you can either access https://my-application.url/swagger-ui/index.html?configUrl=/v3/api-docs/swagger-config directly or set server.tomcat.use-relative-redirects=true in your application.properties

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions