Should validators recognize schema meta-schema URIs using https on older drafts?

[jimmylewis]

Draft 2020-12 was the first version of JSON Schema which uses https:// as the protocol in the meta-schema URI (section 5). However, I have encountered several Visual Studio users who have tried using the https protocol for older drafts (e.g. "$schema": "https://json-schema.org/draft-07/schema#"). The https URIs are also suggested from the SchemaStore.org catalog (example).

Strictly speaking, these are invalid as they do not match the schema. However, at https://json-schema.org/specification-links.html#draft-2019-09-formerly-known-as-draft-8 it says:

NOTE: All meta-schema URIs now use https://. While currently also available over plain HTTP due to the limitations of GitHub pages and the need to keep prior drafts available over HTTP, only the HTTPS URIs should be used.

Is this note a supplementary change to the schemas, or simply a note on the URI for serving the validation schema? Should validators accept $schema values using https for older draft specifications?

[Relequestual]

Hey @jimmylewis, great question. Let's unpack it and answer it for you.

In JSON Schema, the value of $schema is a URI which identifies the "JSON Schema Dialect" with which the JSON Schema resource should be processed.

A "JSON Schema Dialect" is sort of like a version of JSON Schema, but it may use the same version of JSON Schema with some extensions also.

The URI which identifies draft-07 and previous uses http while 2019-09 and newer use https.
Note, I said the URI. For our purposes here, the URI is an exact specific string identifer.

Simply, in answer to your exact question, no. Meta-schema URIs, which are the same as "dialect" URIs, are fixed, exactly as is. The protocol doesn't matter.

That being said, what you're seing in the SchemaStore catalog is a URL, not a URI, which tells you how to access the meta-schema.

We COULD choose to not surve the meta-schemas at the same URL as the URI they use for their identity. Someone else could also host the meta-schemas if they wanted to, but their identifiers would always be that defined in their $id value (and for the official JSON Schema meta-schemas, in the specification itself).

What might be happening in some implementations is, the URI is not recognised, so it's taken as a URL, and attempts to download a meta-schema from that location, which it then treats and uses as the meta-schema. This is allowed for $ref, but I'm not convinced this is allowed (nor prohibited) by the specification. It's done as a convenience but has potential security implications.

I hope that answers your question. Please feel free to follow up.