buildSubscriptionURL() doesn't choose wss when graphiql served by https

[bkcsfi]

Hi, we are now deploying our tartiflette-based backend for internal use, but wish to continue to support graphiql for a while longer.

We're running our app in docker swarm with traefik front-end with tls support (client to traefik), and non-tls from traefik to the backend app.

when I load https://my-app.mydomain.com/graphiql .. the page loads but returns this error

client.js:1571 Mixed Content: The page at 'https://my-app.mydomain.com/graphiql' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://caentry-dev.svc.sfi.ca/ws'. This request has been blocked; this endpoint must be available over WSS.	

I think the issue is that buildSubscriptionURL() doesn't check to see if the html was loaded over https, so only chooses the 'ws' scheme instead of the 'wss' scheme.

I think checking window.location.protocol to see if it's https: would solve this?

[abusi]

Hi @bkcsfi I missed this issue completly, are you still experiencing this problem ?

If I resume, you want the code to choose the wss protocol if window.location.protocol is https ?

Thanks for this bug report.

[tsunammis]

@bkcsfi Just to make sure that you are not still facing this issue.

you want the code to choose the wss protocol if window.location.protocol is https ?

[bkcsfi]

Hi,

We're still on 0.6.3, I will setup a branch to test 0.8.0 and let you know

thanks

[bkcsfi]

Hi, we've upgraded to 0.8.2 and we still have a problem with this

I believe the issue is here https://github.com/tartiflette/tartiflette-aiohttp/blob/master/tartiflette_aiohttp/_graphiql.html#L154

There doesn't appear to be any check to determine if graphiql has been loaded via https or not.

chrome says this:

client.js:1571 Mixed Content: The page at 'https://redacted.url/graphiql' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://redacted.url/ws'. As part of an experiment this request was automatically upgraded to HTTPS, For more information see https://chromium.googlesource.com/chromium/src/+/master/docs/security/autoupgrade-mixed.md

Where client.js is from https://cdn.jsdelivr.net/npm/subscriptions-transport-ws@0.7.0/browser/client.js

it's using the url passed from buildSubscriptionURL()

do you need PR? I could take a shot at it.

[abusi]

@bkcsfi Really sorry for the waiting time about this PR, if you could do a PR to fix it, it would be very cool. Thank you.

[bkcsfi]

sorry I wasn't able to generate a PR this week, thanks for taking care of it.