graph view API call blocked due to mixed content

[andrecastro0o]

Morning, Recently we deployed an instance of OLS for nfdi4chem, and we are having a issue with the graph view, which failing to produce the graph.

The issue seems to result from the graph's GET call to OLS API, which is done over http while the OLS instance is served over https, resulting in a mixed content, which is blocked by Firefox (see image and JSON ), as:

An HTTPS page that includes content fetched using cleartext HTTP is called a mixed content page. Pages like this are only partially encrypted, leaving the unencrypted content accessible to sniffers and man-in-the-middle attackers. That leaves the pages unsafe. https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content

graph GET call:

{
    "GET": {
        "scheme": "http",
        "host": "terminology.nfdi4chem.de",
        "filename": "/api/ontologies/bfo/terms/http%253A%252F%252Fpurl.obolibrary.org%252Fobo%252FBFO_0000002/graph"
    }
}

You can see the issue yourself at https://terminology.nfdi4chem.de/ts/ontologies/bfo/terms/graph?iri=http://purl.obolibrary.org/obo/BFO_0000002

The blocked API call is: http://terminology.nfdi4chem.de/api/ontologies/bfo/terms/http%253A%252F%252Fpurl.obolibrary.org%252Fobo%252FBFO_0000002/graph

I am struggling to understand why the API call is done to http: when OLS is using https.

Also I am not able to figure out how and where - think it will be in the client side JS code - the API call is constructed.

If you could please let us know of possible solutions to mitigate this issue, it will be highly appreciated.

[andrecastro0o]

No ideas?

This is strange because in other paths of OLS-web, such as ontologies/bfo the API is called using HTTPS as in API, such as https://terminology.nfdi4chem.de/ts/api/ontologies/bfo/terms/roots?size=500

[jamesamcl]

Hi, apologies, I didn't see this. I'll have a look.

[jamesamcl]

I think this is because HATEOS generates http links instead of https links in the pagination. I seem to recall this was fixed by adding a X-Forwarded-Proto header.

Are you using the OntoTools Docker config?

[andrecastro0o]

@udp thank you! The issue was solved by enforcing HTTPS, by as you suggested adding a X-Forwarded-Proto header.

which we did under the NGINX ols location, by adding proxy_set_header X-Forwarded-Proto https;