How to serve swagger over https? What are the correct settings?

[siulkilulki]

I have working swagger when accessing it over HTTP, but when I try to access it over HTTPS I get following error:
swagger-ui.min.js:10 Mixed Content: The page at 'https://www.little-hero.tk/api/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://www.little-hero.tk/api/swagger.json'. This request has been blocked; the content must be served over HTTPS.

Full printscreen: http://i.imgur.com/jms8bdh.png

What should I do? There is no information in docs. I'm using cloudflare to get https if it helps.

[ziirish]

Your issue looks similar to #132
Maybe you can have a look at this issue and try out the proposed fix.

[cwalkatron]

I fixed this like this:

from werkzeug.contrib.fixers import ProxyFix
application.wsgi_app = ProxyFix(application.wsgi_app)

[heaje]

@cwalkatron: I just added the way I fixed this same issue to #132

[jnguyenx]

@cwalkatron can you please show more code how you fixed it? I tried to use the ProxyFix without any success.

...
from werkzeug.contrib.fixers import ProxyFix

app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app)
...

Even with that I still get the cross-origin issue.

[jnguyenx]

I was missing one line in my nginx.conf proxy_set_header X-Forwarded-Proto $scheme;. Otherwise I used this nginx config, but didn't include the ProxyFix.

[lybroman]

With the update of werkzeug to 0.15. The above fix may need some parameters update to work as before. We are using the ELB of AWS, so need to update the x_ parameters accordingly.

[davidism]

Absolutely do not make a broad recommendation to set every value to 1. Each value should be set based on the specific hosting setup for each application. This is relevant to security, and is described in the documentation for ProxyFix. The default of x_for=1, and possibly x_host=1, is what's needed in most cases, but again you need to verify that the proxy is actually setting those headers.

[ziirish]

Hi,

The discussions will take place in #223 since your issue is quite similar.

[ziirish]

I'm now closing this issue.
Please follow discussions in #223

[c24b]

Related to #132 where I found the correct Fix for Flask-Restplus with Nginx and gunicorn