Both HTTP and HTTPS ports cannot be specified

[prantlf]

I have an API exposed on custom ports:

http://server:8000/api
https://server:8443/api

When I test the API with https://editor.swagger.io, I can switch the protocol from HTTP to HTTPS on the page, but because the port is entered only once with the host together and used for both schemes, I cannot actually send the request to the correct HTTPS endpoint:

host: server:8000
basePath: /api
schemes:
  - http
  - https

Why not adding an additional property configuring the HTTP and HTTPS ports?

[webron]

That's a good point.

[earth2marsh]

👍

[mohsen1]

My opinion:

We should make it possible to provide a list of hosts. Swagger should not be deterministic which host should be used for which scheme.

[fehguy]

Is it unreasonable to expect that https is always 443?

[webron]

Yes. The OP.

[casualjim]

I'm all for scheme: port type of mapping

while swagger assumes it's http there is also wss in there and soon there is server push and so on with http2.
Now there is no reason why somebody couldn't expose the swagger api over a rabbitmq messsage bus or some zeromq interface which supports these messaging paradigms.

the host can be assumed to be the same but a scheme represents more often than not a port.

[olensmar]

I agree - I think it would be insanely cool (almost) if one could open up for using swagger to describe APIs exposed over other protocols than HTTP(s) - (I'm primarily thinking CoAP, MQTT, WebSockets)

[webron]

And pigeons.

[fehguy]

@olensmar have you seen this project?

https://github.com/swagger-api/swagger-socket

Unbelievable potential with this.

[ndhar-1]

Just out of curiosity, when you say you want to expose the APIs on both http and https, you intend to accept both secured and unsecured connections? I think it defeats the purpose of having security ... ?

[prantlf]

Well, discussing security is out of the scope of this issue, isn't it? :-)

I can't know for what purpose is the API on the p[articular port used, how the connection is allowed the access to and how it is secured. All I deal with is that the server offers both schemes. I can either document and test both of them with Swagger, or I can use only one there.

I agree that unless more details are given, using https is a "must" for the usual REST API security.

[webron]

Parent: #560.