如何解决生产环境中Swagger UI的混合内容错误？

近期从SpringFox 2迁移到Springdoc + OpenAPI 3，本地运行正常且性能更优，但部署到生产环境后，Swagger UI页面能正常打开，但调用API时出错，浏览器控制台提示：

Mixed Content: The page at 'https:///swagger-ui/index.html#/Ravel/getLabelFormats' was loaded over HTTPS, but requested an insecure resource 'http:///labels?language=10&includeData=false'. This request has been blocked; the content must be served over HTTPS.

现有配置 #

CORS配置 #

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
    registry.addResourceHandler("swagger-ui.html")
            .addResourceLocations("classpath:/META-INF/resources/");

    registry.addResourceHandler("/webjars/**")
            .addResourceLocations("classpath:/META-INF/resources/webjars/");
}

@Override
public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**").allowedOrigins("*");
}

POM依赖 #

<dependency>
    <groupId>org.springdoc</groupId>
    <artifactId>springdoc-openapi-ui</artifactId>
    <version>1.6.9</version>
</dependency>

<dependency>
    <groupId>io.swagger.core.v3</groupId>
    <artifactId>swagger-annotations</artifactId>
    <version>2.2.8</version>
</dependency>

<dependency>
    <groupId>io.swagger.core.v3</groupId>
    <artifactId>swagger-models</artifactId>
    <version>2.2.8</version>
</dependency>

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-handler</artifactId>
    <version>4.1.79.Final</version>
</dependency>

application.yml配置 #

springdoc:
  swagger-ui:
    enabled: true
    disable-swagger-default-url: true
  api-docs:
    path: /v3/api-docs

当前环境：Java 8、Spring Boot 2.7.8

解决方案 #

问题核心是生产环境用HTTPS访问Swagger UI，但OpenAPI生成的接口地址是HTTP，触发浏览器混合内容拦截。可通过以下方式修复：

1. 直接配置Springdoc服务器地址 #

在application.yml中指定生产环境的HTTPS服务器地址：

springdoc:
  swagger-ui:
    enabled: true
    disable-swagger-default-url: true
  api-docs:
    path: /v3/api-docs
  servers:
    - url: https://<myproductionAPIUrl>
      description: Production Server

2. 代码配置OpenAPI实例 #

创建配置类手动设置服务器地址：

import io.swagger.v3.oas.models.OpenAPI;
import io.swagger.v3.oas.models.servers.Server;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.List;

@Configuration
public class OpenApiConfig {

    @Bean
    public OpenAPI customOpenAPI() {
        return new OpenAPI()
                .servers(List.of(new Server().url("https://<myproductionAPIUrl>")));
    }
}

3. 适配反向代理场景 #

如果生产环境有Nginx等反向代理，配置Spring Boot识别外部HTTPS请求头：

server:
  forward-headers-strategy: FRAMEWORK
  tomcat:
    remote-ip-header: X-Forwarded-For
    protocol-header: X-Forwarded-Proto

同时确保反向代理传递正确的头信息，示例Nginx配置片段：

location / {
    proxy_pass http://your-backend-server;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-For $remote_addr;
}

内容的提问来源于stack exchange，提问作者Palio