Automatically closed - issue fixed for 2 weeks with no activity.
Possibly related to the jsonapi module. I have found that when making a subrequests POST over https to a jsonapi endpoint, the response body for the request doesn't use https for the links, e.g. for image urls or resource links.
For example:
POST https://example.com/subrequests?_format=json
[
{
"requestId": "1",
"uri": "/jsonapi/node/page/67b7deb2-0053-4f92-8773-2b2e22b73509",
"action": "view"
}
]
Gives the response:
{
"1": {
"headers": {...},
"body": "{\"data\":{\"type\":\"node--page\",\"id\":\"67b7deb2-0053-4f92-8773-2b2e22b73509\",\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\"}},\"attributes\":{\"drupal_internal__nid\":1,\"drupal_internal__vid\":5,\"langcode\":\"en\",\"revision_timestamp\":\"2019-06-05T10:20:39+00:00\",\"revision_log\":null,\"status\":true,\"title\":\"Page 1\",\"created\":\"2018-12-06T14:31:27+00:00\",\"changed\":\"2019-06-05T10:20:39+00:00\",\"promote\":false,\"sticky\":false,\"default_langcode\":true,\"revision_translation_affected\":true,\"scheduled_transition_date\":[],\"scheduled_transition_state\":[],\"content_translation_source\":\"und\",\"content_translation_outdated\":false,\"body\":{\"value\":\"\\u003Cp\\u003ESome content\\u003C\\/p\\u003E\\r\\n\",\"format\":\"rich_text\",\"processed\":\"\\u003Cp\\u003ESome content\\u003C\\/p\\u003E\",\"summary\":\"\"}},\"relationships\":{\"node_type\":{\"data\":{\"type\":\"node_type--node_type\",\"id\":\"21f8f6da-a0dd-4167-ad30-cf8b92cc55e0\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/node_type\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/node_type\"}}},\"revision_uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"b2a3de38-2906-4580-bddf-4505bc0f8894\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/revision_uid\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/revision_uid\"}}},\"uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"b2a3de38-2906-4580-bddf-4505bc0f8894\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/uid\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/uid\"}}}}},\"jsonapi\":{\"version\":\"1.0\",\"meta\":{\"links\":{\"self\":{\"href\":\"http:\\/\\/jsonapi.org\\/format\\/1.0\\/\"}}}},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\"}}}"
}
}
In the body, the resource links, e.g. {{1.body@$.links.self.href}} are http://
However, if you request the resource directly through jsonapi, the resource links correctly pick up https.
Initially I thought this was due to the reverse proxy I had, but the Drupal settings are correct for that, and I've also tested it without a proxy with the same results.
I've also tried forcing the uri in the request body, but see the same:
POST https://example.com/subrequests?_format=json
[
{
"requestId": "1",
"uri": "https://example.com/jsonapi/node/page/67b7deb2-0053-4f92-8773-2b2e22b73509",
"action": "view"
}
]
Let me know if you need anymore information.
Fixed
3.0
Code
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Automatically closed - issue fixed for 2 weeks with no activity.