OWASP/crAPI

Inacessible mechanic_api when using HTTPS

Closed this issue · 2 comments

Describe the bug
"Could not connect to mechanic api" message when opening a service request due to HTTPS

To Reproduce
Configure access to crapi via HTTPS. Signup and configure your vehicle.
Try creating a service request.
WebUI shows the error: "Could not connect to mechanic api."
Service request is not created.

Checking the POST request done when creating the service request, we have the following request body:

{"mechanic_code":"TRAC_JHN","problem_details":"Hi John, I am opening this request to replace blinker fluid\n","vin":"3GWHK50SJRX079062","mechanic_api":"https://crapi.testlab.local/workshop/api/mechanic/receive_report","repeat_request_if_failed":false,"number_of_repeats":1}

The response body:

{"message":"Could not connect to mechanic api."}

Even though accessing the endpoint manually (https://crapi.testlab.local/workshop/api/mechanic/receive_report) does indeed work, seems like the application is not able to access it.

Manually changing the URL to HTTP only instead of HTTPS apparently solves it:

image

image

Expected behavior
The application should be able to access the mechanic api endpoint, even when using HTTPS.

Runtime Environment
crAPI running behind traefik.
Docker version 20.10.21, build 20.10.21-0ubuntu1~22.04.2
5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Seems like you have setup a domain crapi.testlab.local which may not be understood by internal services.

This should be fixed now in the develop branch