Allow to access Swagger UI on non SSL Express server

src/api/routes/index.js

@@ -1,14 +1,18 @@
 import express from 'express';
+import helmet from 'helmet';
 import swaggerUi from 'swagger-ui-express';
 
 import servicesRouter from './services.js';
 import specsRouter, { specs } from './specs.js';
 
 const apiRouter = express.Router();
 
-apiRouter.use('/specs', specsRouter);
 apiRouter.use('/docs', swaggerUi.serve);
 apiRouter.get('/docs', swaggerUi.setup(specs));
+
+apiRouter.use(helmet()); // Register `helmet` after swaggerUi routes to ensure insecure requests won't be upgraded to secure requests for swaggerUI assets; see https://github.com/scottie1984/swagger-ui-express/issues/212#issuecomment-825803088
+
+apiRouter.use('/specs', specsRouter);
 apiRouter.use('/services', servicesRouter);
 
 export default apiRouter;

src/api/server.js

@@ -1,6 +1,5 @@
 import config from 'config';
 import express from 'express';
-import helmet from 'helmet';
 
 import logger from './logger.js';
 import errorsMiddleware from './middlewares/errors.js';
@@ -9,8 +8,6 @@ import apiRouter from './routes/index.js';
 
 const app = express();
 
-app.use(helmet());
-
 if (process.env.NODE_ENV !== 'test') {
   app.use(loggerMiddleware);
 }