fix(hydra): match Caddy in making docs.jsonld Link header URI relative

[rvanlaak]

This makes the client responsible of matching the original request's protocol.

Q	A
Branch?	main for features / current stable version branch for bug fixes
Tickets	Relates to api-platform/admin#631
License	MIT
Doc PR	api-platform/docs#...

The HydraLinkProcessor includes an absolute URI as Link header, but as the Psr\Link\LinkInterface prescribes it is allowed to have a relative URI as well.

• Caddy also serves a relative URI for the documentation Link in it's default config: https://github.com/api-platform/api-platform/blob/main/api/frankenphp/Caddyfile#L42
• Applications can use http as protocol behind a proxy, resulting in the UrlGenerator based on internal framework requests render a http URL (while the actual client is on https). When using HSTS this will lead in a crashing frontend application (see related issue).

[dunglas]

Why not but if the absolute URL is wrongly generated, this means that Symfony is misconfigured (usually, trusted headers aren’t configured properly) and this will cause other issues for users (for instance when sending mails).

This mitigation will just hide the underlying issue, and require a bit more logic client-side, I’m not against it but I’m also not sure it is worth it.

[rvanlaak]

Thanks for the analysis!

if the absolute URL is wrongly generated, this means that Symfony is misconfigured

In my situation it seems that for some odd reason solely the documentation url gets generated as http, where the entire application is served over https. The stack route; Browser --(https)--> Cloudflare --> Managed loadbalancer --(http)-> k3s --> service --> pod --> Caddy / frankenphp container.

This PR is solely a change for the documentation / entrypoint URI if I'm correct? So generating an ABS_URL for emails thereby would be another responsibility? If I'm correct, the resource's @id's and also are relative.

An analysis on the codebase learns us that @vocab and iri are the sole other reference that have reference to ABS_URL, but I'm not sure how the PublishMercureUpdatesListener would be able to generate an absolute URL when triggered from a background task. Would it not be wiser to make it a client side concern over there as well?

For resources themselves userland is in control: #[ApiResource(urlGenerationStrategy: UrlGeneratorInterface::ABS_URL)]

[soyuka]

I guess there could be a global configuration for this?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.