search

mikekelly / hal-browser

An API browser for the hal+json media type
MIT License
835 stars 157 forks source link

fixed iframe beeing blocked due to insecure requests when using https #84

Closed jkobus closed 8 years ago

jkobus commented 8 years ago

While using https lack of quoting marks around src caused iframe to make an insecure request (http) that was blocked.

mikekelly commented 8 years ago

thanks !!!! :D:D:D

jkobus commented 8 years ago

this is caused by an apache redirect of the documentation url without trailing "/" at the end, for example my apache (with default settings) would 301-you from https:// ... /doc/rel/users to http:// ... /doc/rel/users/.

Without quotation marks the redirect still occurs, as the trailing slash is ignored, so:

src=https:// ... /doc/rel/users/ will 301 you to http:// ... /doc/rel/users/

It causes iframe contents to be blocked.

Im pretty sure I have other problem with my server as it strips down the https for some reason :) but this fix will prevent the hal-browser from going for an unnecessary redirect when doc url is pointing to a directory rather than a file.

Update: Website sits behind cloudflare that causes the client to go to http instead of https during apache's 301 :) :+1:

mikekelly commented 8 years ago

good work, thanks for the detailed analysis too. 👍

jkobus commented 8 years ago

Just a small follow up: so I was using the Flexible SSL at cloudflare that uses only port 80, so my server was giving the http-301 instead of expected https-301. After changing cloudflare ssl setting to "Full SSL" everything works fine.

Have a nice day :)