Swagger UI on https with SSL offloading errors because of json url then uses http

[msivers]

I'm using @vitalybibikov fork (nuget: https://www.nuget.org/packages/AzureExtensions.Swashbuckle/) which is working great for me with Azure Functions v3.1 - but one issue in that I force https and the swagger ui is great but the json explore url defaults to http only, which errors as I don't allow non-https.

[Posting here as @vitalybibikov fork doesn't have issues enabled]

I'm not sure if this happens on this code base too but just wondering if anyone has seen this or better still solved it?

[vitalybibikov]

Hi @msivers

Can you create a repro?

I've checked and it works.

[msivers]

Tried this locally myself and works fine in that context... my production environment is AKS (Azure Kubernetes Service) and I use Azure Application Gateway (via AGIC ingress controller) which does SSL offloading, so that will be why. Not sure if there is an easy way around this - may have to do something in Application Gateway?

[vitalybibikov]

As far as I know Application Gateway currently does not have ability to rewrite URL(things might have changed, as this feature was in developlement), but Azure API Management can do this, if it is an option.

On configuration: AKS + Ocelot (as a gateway) + TLS offload, Ocelot does not provide this ability as well, so we have used a workaraound: https://github.com/ThreeMammals/Ocelot/issues/161#issuecomment-370550860

I guess, the best option is to make both swagger/json and swagger/ui endpoints available outside of the cluster. while rerouting all the requests to their http versions via Gateway.

[msivers]

The Application Gateway Ingress Controller has an annotation - appgw.ingress.kubernetes.io/ssl-redirect: "true" which with redirect which I am now using which is great. This doesn't fix the problem though as the json url will still be 'http' because of the offload and it's then being blocked by the browser as it's mixed content.

We could do with a flag to be set in swashbuckle to ensure all urls are changed to https?

[vitalybibikov]

Ok, I got it.

Though it's not the best option to specify a flag, as there is a need to cover all the cases when domain name is different as well.

I have added new OverridenPathToSwaggerJson option,

            builder.AddSwashBuckle(Assembly.GetExecutingAssembly(), opts =>
            {
                opts.OverridenPathToSwaggerJson = new Uri("https://blablabla.azure-api.net/swagger/json");
            })

which is available in a preview version of the Nuget 3.1.2-beta. =>

Please, review the list of changes, as some of them might be breaking for you. https://github.com/vitalybibikov/azure-functions-extensions-swashbuckle/tree/dev