Using file editor ignores schema and always uses http

[jeffpaulkinsta]

When editing a template/theme or plugin file with the WordPress file editor, the internal loopback which I assume uses wp-json does not honor the schema of the siteurl.

For example:
Siteurl: ​https://kinsta.com

The request will come through as ​http://kinsta.com
If SSL is forced at the server level, this will force the ​https:// schema.

This was recently discovered and was failing because a user's SSL intermediate chain was missing, so the site would edit fine without HTTPS forced, but with SSL forced it would fail.

We were able to identify the chain issue due to this error occuring when force HTTPS was enabled in Nginx:

Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means, such as by using SFTP.

[kadamwhite]

The file editor does not utilize the REST API, so this "focus" keyword is incorrect — I believe "admin" is the correct focus here.

[costdev]

• ​The loopback request uses admin_url() for the URL.
• admin_url() in turn calls get_admin_url() with the $scheme set to admin.
• get_admin_url() calls get_site_url(), passing $scheme.
• get_site_url() calls set_url_scheme(), passing $scheme.
• set_url_scheme() sets the scheme based on the following condition:

  <?php
  
  if ( 'admin' === $scheme || 'login' === $scheme || 'login_post' === $scheme || 'rpc' === $scheme ) {
          $scheme = is_ssl() || force_ssl_admin() ? 'https' : 'http';
  

• is_ssl() returns true if:
  • $_SERVER['HTTPS'] is set to 'on', OR
  • $_SERVER['HTTPS'] loosely evaluates to '1', OR
  • $_SERVER['SERVER_PORT'] is 443.
• force_ssl_admin() returns true if it has previously been called as force_ssl_admin( true ).

---

a user's SSL intermediate chain was missing

This may suggest that the user's SSL certificate was invalid, and should have produced an error about an incomplete chain. Can you clarify whether or not this was the case?