API-Platform Admin-Docker-Container has HTTP link in Response Header of HTTPS-Request behind traefik

user_291470 0
Viewed 398

The current version of api-platform and the examples I found for docker-compose / traefik-1 configs do not work for me.

I figured out a config that works and does what I want: no forwarded ports for all the services, HTTP for the services behind traefik, HTTPS for traefik, Hostnames for the services:

So far, so good, but there is one remaining problem, the admin container sends one correct request to 

https://vulcain.api-platform-new.loc

in my setup, but the second one to 

HTTP://vulcain.api-platform-new.loc:443/docs.jsonld

this seems to happen because the "link"-request header of the https://vulcain.api-platform-new.loc-Request says:

link: <http://vulcain.api-platform-new.loc:443/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"

(mind HTTP vs HTTPS)

enter image description here

which leads to "Something went wrong" because of:

fetchJsonLd.ts:14 Mixed Content: The page at 'https://admin.api-platform-new.loc/#/' was loaded over HTTPS, but requested an insecure resource 'http://vulcain.api-platform-new.loc:443/docs.jsonld'. This request has been blocked; the content must be served over HTTPS.

I spent days on all of this, and I would be really happy, if someone could tell me, how to fix the Response-Header-Link to use httpS!

api-platform.com traefik docker-compose docker
1 Answers

I faced the same issue today. I'm using Traefik as my main gateway server (with Docker) and I have an API platform installation with the API behind a Vulcain docker image. It seems that the port 443 is forwarded in the headers but the proto is HTTP, which leads to the error described in the question. I was not able to configure properly the multiple layers of containers so that the SSL is properly detected all the way. My solution was to edit the front PHP controller to not trust the forwarded port and proto.

In public/index.php :

if ($trustedProxies = $_SERVER['TRUSTED_PROXIES'] ?? $_ENV['TRUSTED_PROXIES'] ?? false) {
  // Do not trust all forwarded headers, only the host and for.
  // @see Request::HEADER_X_FORWARDED_ALL
  Request::setTrustedProxies(explode(',', $trustedProxies), Request::HEADER_X_FORWARDED_FOR && Request::HEADER_X_FORWARDED_HOST);
}

Additionnaly, you can specify an environment variable named HTTPS which will be used by Symfony to set the right scheme for generated URLs. Just put in your .env file the following code :

# Symfony router use HTTPS
# Because we can not trust port/proto forwarded by Vulcain
HTTPS=true

And that's it, your Symfony generated URLs will be using the HTTPS scheme properly. I know the right way should be to configure the containers to forward the right port and proto, but that's the easiest way.

Hope it helps.

user_17566670
Related