Add HTTPS support about schemastore

[marcoscaceres]

Just a bump, as I just ran into this... just noting that schemastore.org providing TLS should not be framed as not holding secrets (as is mentioned in #12 (comment)), but rather that the communication between the client and server should not be open to third-party manipulation or pervasive monitoring (which TLS protects from).

Perhaps Let's Encrypt could be used to provide TLS support for schemastore?

[madskristensen]

it's because it's hosted at the same location as another site. The certificate doesn't apply to schemastore.org and therefore gives the error. HTTPS is currently not supported on schemastore.org since no secrets are stored there

[madskristensen]

It's on the backlog to provide HTTPS support for the site.

[madskristensen]

@styfle Actually, you're seeing the old default cert. Just wait for the dns to propagate fully.

[markromano]

Thank you for your response.

Unfortunately, when my app is running on https server, when I try to
access (via ajax) I get
"was loaded over HTTPS, but requested an insecure
XMLHttpRequest endpoint
'http://schemastore.org/api/json/catalog.json'
http://schemastore.org/api/json/catalog.json%27. This request has been
blocked; the content must be served over HTTPS."

Trying https gave me the error initially mentioned.

Regards,
Mark

On 4/9/2015 4:01 PM, Mads Kristensen wrote:

it's because it's hosted at the same location as another site. The
certificate doesn't apply to schemastore.org and therefore gives the
error. HTTPS is currently not supported on schemastore.org since no
secrets are stored there

—
Reply to this email directly or view it on GitHub
#12 (comment).

[sayedihashimi]

Every azure website has https support on *.azurewebsites.net so you can use https://schemastore.azurewebsites.net for https support until it's enables on the schemastore.org domain.

[markromano]

I see https://schemastore.azurewebsites.net/api/json/catalog.json as the catalog.
Of course since it's a copy, all of the urls in the catalog point to http://json.schemastore.org/.

However, I am unable to find corresponding items on https://schemastore.azurewebsites.net/

e.g., https://schemastore.azurewebsites.net/bower
yields "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable."
https://schemastore.azurewebsites.net/json/bower
directs to the main page.

Is there a different https url pattern to use?

[madskristensen]

There is no official https support yet. You'll have to rewrite the urls yourself to use the azurewebsites.net domain for https.

[markromano]

Thank you for your response -
I understand that I'd have to rewrite the urls from the catalog, but I don't know what to rewrite them to. I haven't been able to locate them on the the azurewebsites.net domain.

So,
http://schemastore.org/api/json/catalog.json
matches to
https://schemastore.azurewebsites.net/api/json/catalog.json
and
http://schemastore.org/json/
matches to
https://schemastore.azurewebsites.net/json/

But what does, for example,
http://json.schemastore.org/bower
match to?

[madskristensen]

https://schemastore.azurewebsites.net/schemas/json/bower.json

[markromano]

Thanks!

[ExE-Boss]

See this: https://docs.microsoft.com/azure/app-service/app-service-web-tutorial-custom-ssl

[styfle]

This is still not working for me: https://schemastore.org/json/

This server could not prove that it is schemastore.org; its security certificate is from *.azurewebsites.net. This may be caused by a misconfiguration or an attacker intercepting your connection.

[madskristensen]

you should have been redirected to https://www.schemastore.org which works. So does https://json.schemastore.org for the individual schemas

[styfle]

@madskristensen Indeed, these work:

• https://json.schemastore.org/json/
• https://www.schemastore.org
• https://www.schemastore.org/json/

But searching for "schemastore" results in https://schemastore.org/json/ as the first hit and this does not work:

• https://www.google.com/search?q=schemastore
• https://www.bing.com/search?q=schemastore
• https://schemastore.org/json/

[madskristensen]

Once search engines re-index, they will update to point to https://www.schemastore.org. It won't take long

[MasterOdin]

https://json.schemastore.org/json/ now leads to an error page: "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable."

[ExE-Boss]

@MasterOdin That’s because the json.schemastore.org subdomain only serves the JSON schema files.

@madskristensen To do that, you’ll need schemastore.org to serve a correct certificate and respond with a redirect to www.schemastore.org.

[madskristensen]

@ExE-Boss @MasterOdin I only have cert support on subdomains. Btw, http://json.schemastore.org/json results in a 404. There's nothing there. However, http://schemastore.org/json/ redirects correctly to https://www.schemastore.org/json/

[ExE-Boss]

http://schemastore.org redirects to https://schemastore.org

[madskristensen]

which redirects to https://www.schemastore.org. You may need to clear your browser data. Use a HTTP header checker tool like this one https://hackertarget.com/http-header-check/