🐛 Fixed api url for the ghost sdk

[kirrg001]

no issue

• mirror LTS behaviour to master
• if your blog or admin url is configured to http, it's still possible that e.g. nginx allows both https/http
• that's why we should generate the api url without protocol in this case
• so it depends how you serve your blog, example:
  • blog url is http://example.com
  • generated api url for the sdk is //example.com (dynamic protocol allowed)
  • you serve your blog via https://example.com, protocol is https
  • you serve your blog via http://example.com, protocol is http
• i am not 100% confident that this is correct, but it reflects how this has worked in LTS (so we port this over for now)

[ErisDS]

I also am not 100% about this because I can no longer remember all the different cases, but if it more accurately matches LTS I think we should ship it and see, we can always tweak it more later.

[kirrg001]

I also am not 100% about this because I can no longer remember all the different cases

I am just leaving my notes here from slack. In case we tackle this again in the future.

It doesn't matter which use case i take, i always end up in the situation that without modifying my allowed origins (client trusted domains), the api url without protocol is unhelpful.

There are always two things to take care of:

A: http->https calls (or the other way around)
B: different domain calls

Both affect cors, because http protocol changes are counted as cross domain requests.

Example why i don't understand the no-protocol case:

• so if my url is configured to http://example.com, but my web server allows https
• no admin url is configured
• Ghost generates //example.com/ghost/v0.1
• Now I go to https://example.com, so Origin is https
• Alright, protocol is dynamic, the frontend requests https://example.com/ghost/v0.1
• Ghost won't allow https requests, because you are doing a cross domain request (protocol is counted as cross domain) and your url is configured to http
• so you have to allow it explicit
• maybe the cors logic in Ghost is incorrect (we have to allow both http+https by default)

So i am looking for the use case which solves a problem, but i can't find one. Maybe my head just hangs.