Response body not picking up https

Created on 5 June 2019, over 5 years ago
Updated 30 March 2023, over 1 year ago

Possibly related to the jsonapi module. I have found that when making a subrequests POST over https to a jsonapi endpoint, the response body for the request doesn't use https for the links, e.g. for image urls or resource links.

For example:

POST https://example.com/subrequests?_format=json
[
    {
        "requestId": "1",
    	"uri": "/jsonapi/node/page/67b7deb2-0053-4f92-8773-2b2e22b73509",
    	"action": "view"
    }
]

Gives the response:

{
    "1": {
        "headers": {...},
        "body": "{\"data\":{\"type\":\"node--page\",\"id\":\"67b7deb2-0053-4f92-8773-2b2e22b73509\",\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\"}},\"attributes\":{\"drupal_internal__nid\":1,\"drupal_internal__vid\":5,\"langcode\":\"en\",\"revision_timestamp\":\"2019-06-05T10:20:39+00:00\",\"revision_log\":null,\"status\":true,\"title\":\"Page 1\",\"created\":\"2018-12-06T14:31:27+00:00\",\"changed\":\"2019-06-05T10:20:39+00:00\",\"promote\":false,\"sticky\":false,\"default_langcode\":true,\"revision_translation_affected\":true,\"scheduled_transition_date\":[],\"scheduled_transition_state\":[],\"content_translation_source\":\"und\",\"content_translation_outdated\":false,\"body\":{\"value\":\"\\u003Cp\\u003ESome content\\u003C\\/p\\u003E\\r\\n\",\"format\":\"rich_text\",\"processed\":\"\\u003Cp\\u003ESome content\\u003C\\/p\\u003E\",\"summary\":\"\"}},\"relationships\":{\"node_type\":{\"data\":{\"type\":\"node_type--node_type\",\"id\":\"21f8f6da-a0dd-4167-ad30-cf8b92cc55e0\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/node_type\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/node_type\"}}},\"revision_uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"b2a3de38-2906-4580-bddf-4505bc0f8894\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/revision_uid\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/revision_uid\"}}},\"uid\":{\"data\":{\"type\":\"user--user\",\"id\":\"b2a3de38-2906-4580-bddf-4505bc0f8894\"},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/relationships\\/uid\"},\"related\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\\/uid\"}}}}},\"jsonapi\":{\"version\":\"1.0\",\"meta\":{\"links\":{\"self\":{\"href\":\"http:\\/\\/jsonapi.org\\/format\\/1.0\\/\"}}}},\"links\":{\"self\":{\"href\":\"http:\\/\\/example.com\\/jsonapi\\/node\\/page\\/67b7deb2-0053-4f92-8773-2b2e22b73509\"}}}"
    }
}

In the body, the resource links, e.g. {{1.body@$.links.self.href}} are http://

However, if you request the resource directly through jsonapi, the resource links correctly pick up https.

Initially I thought this was due to the reverse proxy I had, but the Drupal settings are correct for that, and I've also tested it without a proxy with the same results.

I've also tried forcing the uri in the request body, but see the same:

POST https://example.com/subrequests?_format=json
[
	{
    	"requestId": "1",
    	"uri": "https://example.com/jsonapi/node/page/67b7deb2-0053-4f92-8773-2b2e22b73509",
    	"action": "view"
	}
]

Let me know if you need anymore information.

🐛 Bug report
Status

Fixed

Version

3.0

Component

Code

Created by

🇬🇧United Kingdom pkht Bristol

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024