Drf-yasg: Detect url scheme when behind proxy

[elnappo]

I'm running Django behind a nginx-ingress as a proxy which also handles HTTPS termination. This leads to the problem that drf-yasg autodetecs HTTP scheme as the connection between Django and nginx is HTTP. Therefore the generated swagger file points to the HTTP scheme and the swagger-ui is not correctly working as the browser blocks mixed content requests.

Mixed Content: The page at 'https://www.example.com/api/swagger/' was loaded over HTTPS, but requested an insecure resource 'http:///www.example.com/api/user/'. This request has been blocked; the content must be served over HTTPS.

I don't want to set DEFAULT_API_URL as Django runs inside a container and this container does not and should not know the hostnames it serves or the upstream protocol behind proxy.

This could be resolved by using the X-Forwarded-Proto HTTP header, which is set by the upstream proxy, in the OpenAPISchemaGenerator class.

[axnsan12]

Hello,

This is a problem that concerns Django configuration. drf-yasg uses HttpRequest.build_absolute_uri to detect the current URL. When running behind a proxy you have to properly configure Django to respect the headers set by the proxy.

The article below is about Apache as a reverse proxy, but the idea of it still holds:
https://design.canonical.com/2015/08/django-behind-a-proxy-fixing-absolute-urls/

You could also look at the testproj configuration which works just fine behind Heroku https: https://drf-yasg-demo.herokuapp.com/

[lapolonio]

New article location: https://ubuntu.com/blog/django-behind-a-proxy-fixing-absolute-urls