API browser in UI no longer preserves correct HTTP scheme in links when using HTTPS #4421

New Issue

adam · 2025-12-29T18:35:50+01:00

adam commented

2025-12-29 18:35:50 +01:00

Originally created by @ajknv on GitHub (Dec 30, 2020).

Environment

Python version: 3.9
NetBox version: 2.10.2

Steps to Reproduce

Set up Netbox to be served via HTTPS (nginx details omitted).
Navigate to https://netboxdev.dcim.nvidiagrid.net/api/
Inspect the generated links to the API sub-paths.

Expected Behavior

The links should use the same scheme (HTTPS) as the originating page. This was the behavior as of at least v2.6.11, so the change in observed behavior is a regression at some point since that version.

Observed Behavior

The links all use plain HTTP as the scheme. Attempting to follow them results in a timeout on a properly configured server that isn't permitting unencrypted HTTP traffic (i.e. configured consistently).

Originally created by @ajknv on GitHub (Dec 30, 2020). ### Environment * Python version: 3.9 * NetBox version: 2.10.2 ### Steps to Reproduce 1. Set up Netbox to be served via HTTPS (nginx details omitted). 2. Navigate to https://netboxdev.dcim.nvidiagrid.net/api/ 3. Inspect the generated links to the API sub-paths. ### Expected Behavior The links should use the same scheme (HTTPS) as the originating page. This was the behavior as of at least v2.6.11, so the change in observed behavior is a regression at some point since that version. ### Observed Behavior The links all use plain HTTP as the scheme. Attempting to follow them results in a timeout on a properly configured server that isn't permitting unencrypted HTTP traffic (i.e. configured consistently).

adam closed this issue

2025-12-29 18:35:50 +01:00

adam commented

2025-12-29 18:35:51 +01:00

@candlerb commented on GitHub (Jan 1, 2021):

It Works For Me™, tested with Netbox 2.10.2 and Apache as the proxy:

$ curl https://netbox.example.net/api/
{"circuits":"https://netbox.example.net/api/circuits/","dcim":"https://netbox.example.net/api/dcim/","extras":"https://netbox.example.net/api/extras/","ipam":"https://netbox.example.net/api/ipam/","plugins":"https://netbox.example.net/api/plugins/","secrets":"https://netbox.example.net/api/secrets/","status":"https://netbox.example.net/api/status/","tenancy":"https://netbox.example.net/api/tenancy/","users":"https://netbox.example.net/api/users/","virtualization":"https://netbox.example.net/api/virtualization/"}

(Also tested in a browser - all the links shown have https://)

My Apache configuration has:

    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}

You'll need the equivalent for Nginx, which I believe is here:

        proxy_set_header X-Forwarded-Proto $scheme;

@candlerb commented on GitHub (Jan 1, 2021): It Works For Me™, tested with Netbox 2.10.2 and Apache as the proxy: ``` $ curl https://netbox.example.net/api/ {"circuits":"https://netbox.example.net/api/circuits/","dcim":"https://netbox.example.net/api/dcim/","extras":"https://netbox.example.net/api/extras/","ipam":"https://netbox.example.net/api/ipam/","plugins":"https://netbox.example.net/api/plugins/","secrets":"https://netbox.example.net/api/secrets/","status":"https://netbox.example.net/api/status/","tenancy":"https://netbox.example.net/api/tenancy/","users":"https://netbox.example.net/api/users/","virtualization":"https://netbox.example.net/api/virtualization/"} ``` (Also tested in a browser - all the links shown have `https://`) My Apache configuration has: ``` RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} ``` You'll need the equivalent for Nginx, which I believe is [here](https://github.com/netbox-community/netbox/blob/develop/contrib/nginx.conf#L20): ``` proxy_set_header X-Forwarded-Proto $scheme; ```

adam commented

2025-12-29 18:35:51 +01:00

@ajknv commented on GitHub (Jan 4, 2021):

Ah, indeed you are right. Looks like this setting got removed from the default nginx configuration in the community docker image deployment for some reason, and I didn't notice. Sorry for the noise.

@ajknv commented on GitHub (Jan 4, 2021): Ah, indeed you are right. Looks like this setting got removed from the default nginx configuration in the community docker image deployment for some reason, and I didn't notice. Sorry for the noise.

adam commented

2025-12-29 18:35:51 +01:00

@candlerb commented on GitHub (Jan 4, 2021):

5624ecc65e

Seems to be because they don't expect the docker container itself to terminate https, but for there to be another proxy upstream which is doing this.

@candlerb commented on GitHub (Jan 4, 2021): https://github.com/netbox-community/netbox-docker/commit/5624ecc65eeeffc0f2cbed5aa99a3155e3c143db Seems to be because they don't expect the docker container itself to terminate https, but for there to be *another* proxy upstream which is doing this.

adam referenced this issue

2025-12-29 21:46:02 +01:00

Improve contrast of red and green background colors in the changelog #11498

Sign in to join this conversation.

Branches Tags

main

21166-asn4-filtering-graphql

21160-filterset

21039-avif-image-format-support-for-image-upload

21178-change-rack-dimensions-display-to-be-more-consistent

20383-rack-face

21134-rename

21118-site

20911-dropdown-2

20911-dropdown

21124-moduletype-front-ports

21140-panel-label-translations

21050-device-oob-ip-may-become-orphaned

21102-fix-graphiql-explorer

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#4421