Best way to return a link in a REST response

[Mateus Lucio]

Hello everyone!

I was reading some online posts and articles related to links (href) in a json/xml response.
When I looked up "hypermedia" I found some examples like this:

<order self='http://example.com/customers/1234' > <amount>23</amount> <product ref='http://example.com/products/4554' /> <customer ref='http://example.com/customers/1234' /> </order>

This would work just fine except for one detail. The protocol (http). What if my application is responsible for returning this link without knowing if the client uses http or https?
This way the client has to figure out what's the correct protocol and I'd like to avoid that but would this be acceptable?
<order self='example.com/customers/1234' > <amount>23</amount> <product ref='example.com/products/4554' /> <customer ref='example.com/customers/1234' /> </order>

Or this would be better?

<order self='http://example.com/customers/1234' > <amount>23</amount> <product ref='http://example.com/products/4554' secure-ref="https://example.com/products/4554"/> <customer ref='http://example.com/customers/1234' secure-ref="http://example.com/customers/1234"/> </order>

Thanks in advance!

[Bear Bibeault]

Why wouldn't the REST API return the correct protocol? It knows it, after all.

Or, return protocol-less URIs.

You might also be interested in reading about HAL+JSON

[Mateus Lucio]

Hi there!
Hm, well, I think I need to give a little more detail...

My API returns something like this:
<response> <data ref="http://static.mydomain.com/some-file.pdf" /> </response>

So, the first problem is, I'm serving files.
Second, they're under a static domain which is not the same as my app. The app is running under my-app.domain.com for example.
So this is not valid:
<response> <data ref="/some-file.pdf" /> </response>

I have client apps running under http and https but right now if and https app uses my service it can't just render "http://static.mydomain.com/some-file.pdf" on a webpage because the browser will block the file, considering it an unsafe content.

[Bear Bibeault]

Bear Bibeault wrote:Why wouldn't the REST API return the correct protocol? It knows it, after all.

[Ron McLeod]

Bear Bibeault wrote:Why wouldn't the REST API return the correct protocol? It knows it, after all.

If the web service server was behind a SSL/TLS termination proxy, it would see http even if the request used https.

Edit: I just saw that Amazon was saying they were going to add a X-Forwarded-Proto header to identify the original protocol to deal with this specific case.

Mateus Lucio wrote:My API returns something like this:
<response> <data ref="http://static.mydomain.com/some-file.pdf" /> </response>

As Bear mentioned, you should be able to return a protocol-less/scheme-less reference such as:
<response> <data ref="//static.mydomain.com/some-file.pdf" /> </response>

[Bear Bibeault]

The latter is my approach.

[Mateus Lucio]

It does work for me
I rushed myself and did not pay attention to the protocol-less uri recommendation.

This approach works perfectly!

Thank you Bear and Ron for your replies!