Paginated v3 API responses return `http://` next/previous links on the public instance

[lamppu]

Hi!

Not sure if this is the correct place to report this as it might be an infrastructure configuration issue, but when making queries to the paginated endpoints like v3/advisories or v3/packages on https://public.vulnerablecode.io, the "next" and "previous" fields in the response have URLs like

"next": "http://public.vulnerablecode.io/api/v3/advisories/?page=3"
"previous": "http://public.vulnerablecode.io/api/v3/advisories",

for example, instead of https.

Reproduce:

curl -X POST "https://public.vulnerablecode.io/api/v3/advisories/" \
  -H "Content-Type: application/json" \
  -H "User-Agent: VCIO_API_AGENT" \
  -d '{
    "purls": [
      "pkg:npm/%40angular/common@16.2.12",
      "pkg:npm/%40angular/compiler@16.2.12",
      "pkg:npm/%40angular/core@16.2.12",
      "pkg:npm/%40angular/platform-server@16.2.12",
      "pkg:npm/acorn@2.7.0",
      "pkg:npm/brace-expansion@1.1.8",
      "pkg:npm/echarts@6.0.0",
      "pkg:npm/esbuild@0.27.2",
      "pkg:npm/jsdom@9.5.0",
      "pkg:npm/lodash@4.17.21",
      "pkg:npm/minimatch@3.0.5",
      "pkg:npm/qs@6.5.5",
      "pkg:npm/request@2.88.2",
      "pkg:npm/tar@6.2.1",
      "pkg:npm/tough-cookie@2.5.0",
      "pkg:npm/uuid@3.4.0",
      "pkg:maven/ch.qos.logback/logback-core@1.3.14",
      "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3",
      "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.3"
    ]
  }' \
  | jq -r '.next'

returns http://public.vulnerablecode.io/api/v3/advisories/?page=2

[pombredanne]

Thanks for the report!

[pombredanne]

@TG1999 any idea what caused this?

[TG1999]

@pombredanne let me check this