# server-urls

Source: https://apigenie.pl/docs/linter/openapi/rules/server-urls

This rule warns if a server defined by an OpenAPI schema uses HTTP protocol
while not being from localhost, or uses upper-case letters.

## Rule Details

Using HTTP for non-localhost servers can lead to security issues, and using
upper-case letters in URLs can lead to potential case sensitivity problems.

The `server-urls` rule is designed to ensure that all servers defined in an
OpenAPI schema use HTTPS protocol unless they are from localhost, and that
they do not use upper-case letters.

## Configuration

The optional `upgradeHttp` boolean controls whether automatic fixes upgrade
non-local `http` URLs to `https`. It defaults to `false`.

## Examples

**Good**.

```yaml
servers:
    - url: https://api.example.com/v1
        description: Production server
    - url: http://localhost:8080/v1
        description: Local development server
```

**Bad**.

```yaml
servers:
    - url: http://api.example.com/v1
        description: Production server
    - url: https://API.EXAMPLE.COM/v1
        description: Production server with upper-case letters
```

## When Not to Use It

We recommend to always enable this rule.

## Automatic fixes

When invoked with `--fix`, this rule lowercases URL schemes and hostnames. It
preserves credentials, ports, paths, query strings, fragments, and server
variable spelling because those values can be case-sensitive.

Set `upgradeHttp: true` to also change non-local `http` schemes to `https`.

## Compatibility

This rule is compatible with all OpenAPI 3.x versions.