Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't create insecure clients by default #3015

Open
FSchumacher opened this issue Feb 25, 2025 · 0 comments
Open

Don't create insecure clients by default #3015

FSchumacher opened this issue Feb 25, 2025 · 0 comments

Comments

@FSchumacher
Copy link

Problem

client.NewAviClient generates clients, that are insecure by default

Description

Calling NewAviSession will create a new AviSession. In avisession.go line 365 the library uses InsecureSkipVerify: true, when constructing a new http client. This completely ignores the value of avess.insecure, which is set a few lines above (line 321) or by the options in line 326.

The only way to get a secure http client (inside the AVI session) is to construct the http client first and set it via the options mechanism, by using the following code:

tlsConfig := tls.Config{
	InsecureSkipVerify: false,
}
httpClient := &http.Client{Transport: &http.Transport{TLSClientConfig: &tlsConfig}}

client, err := clients.NewAviClient(apiEndpoint, apiUser, session.setClient(httpClient)) 

Apart from being more work than using a secure default setup, it is surprising for the user, as there is a session.SetInsecure option (and no session.SetSecure option), which wrongly implies, that the session is secure by default.

Expected behaviour

By default a secure http client is created and used inside the AVI session, which can be configured to be insecure, when needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant