spring-boot-starter-data-rest 1.2.0 generates links using http instead of https

[hg-schneider]

I have written a spring boot application which is using spring-boot-starter-data-jpa.
The application is configured to use https only. When I use Version 1.1.10 the generated links in the documents send by the server are using https as a protocol. If I switch to version 1.2.0 the links are generated with http protocol, which is not available in my application.

To reproduce this I've provided a simple example. This is a slightly changed version of the gs-accessing-data-rest example (https://github.com/hg-schneider/gs-accessing-data-rest).

In the complete folder I've changed the build to use jetty and enabled https. If you checkout HEAD which is using spring boot version 1.2.0, run the application and curl it with curl -k https://localhost:8443 you receive a document with links using http.

If you checkout the previous commit (git checkout c9b04504) you get the same sources but using spring boot 1.1.10. Running this and curl it again with curl -k https://localhost:8443 you will receive a document with links using https links.

Thanks for developing spring.

[snicoll]

This is most probably due to a change in Spring Data Rest since the auto-config in Boot is pretty straightforward and hasn't changed much since 1.x

ping @olivergierke

[philwebb]

Actually this looks like it's something specific to Jetty. Spring Data is calling ServletUriComponentsBuilder.fromServletMapping(...) and for some reason the HttpServletRequest has a scheme of http and not https.

[philwebb]

@wilkinsona Any chance of a review of fe20116? I've based the code on this: http://blog.denevell.org/jetty-9-ssl-https.html.

[philwebb]

Reopening for review. We should also add a test case.

[wilkinsona]

config.setSecureScheme("https");
config.setSecurePort(port);

I'm not sure that these two lines are necessary. My understanding is that they only take effect when redirecting from HTTP to HTTPS so setting them on an HTTPS connector is pointless.

[wilkinsona]

I think, and you did too, that we should add a test case for this. Reopening to remind me to do it tomorrow.