event.request().absoluteURI() returns an HTTP URL for a HTTPS request in Dev UI

[gsmet]

I don't know if it's a problem specific to Dev UI or not but it was reproduced in the Dev UI using:

https://github.com/rsvoboda/code-with-quarkus/ at commit e8e79723136a9062e013a4c3d705e3c12cd301d2

Reproducing the issue is easy:

• Start with mvn quarkus:dev
• Go to https://localhost:8443/dev/ui (and discard the warning about the certificate)
• Go to the config editor
• Change a value of the top property (a datasource one) and validate the change
• You won't get any success message and if you open the network console, you will see that the POST actually tried to redirect to a HTTP URL (see Location header of the 303 response), which leads to a CORS error (it's easier to see that in the Firefox dev console, I had trouble having the information with a Chromium-based browser)

The problem is that we end up with event.request().absoluteURI() returning an HTTP URL here: https://github.com/quarkusio/quarkus/blob/2.14/extensions/vertx-http/dev-console-runtime-spi/src/main/java/io/quarkus/devconsole/runtime/spi/DevConsolePostHandler.java#L78 so Quarkus tries to redirect to an HTTP URL and it's intercepted by the CORS checks.

[gsmet]

@cescoffier assigning this to you at least for finding out what's going on.

[cescoffier]

So... it's a virtual channel "issue" or "feature".

The virtual server/channel used by the dev console does not have the SSLHandler, because it's a virtual thing. Unfortunately, the scheme() method checks if we have the SSLHandler in the netty pipeline, which we don't in this case.

I need to think if we need to fix it or not (and how).

[cescoffier]

Let's keep it like this for now. If it because a prominent issue we can revisit it, but adding the SSL Handler to the virtual channel is tricky as it needs to be the same handler as the main one.