You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
client.NewAviClient generates clients, that are insecure by default
Description
Calling NewAviSession will create a new AviSession. In avisession.go line 365 the library uses InsecureSkipVerify: true, when constructing a new http client. This completely ignores the value of avess.insecure, which is set a few lines above (line 321) or by the options in line 326.
The only way to get a secure http client (inside the AVI session) is to construct the http client first and set it via the options mechanism, by using the following code:
Apart from being more work than using a secure default setup, it is surprising for the user, as there is a session.SetInsecure option (and no session.SetSecure option), which wrongly implies, that the session is secure by default.
Expected behaviour
By default a secure http client is created and used inside the AVI session, which can be configured to be insecure, when needed.
The text was updated successfully, but these errors were encountered:
Problem
client.NewAviClient
generates clients, that are insecure by defaultDescription
Calling
NewAviSession
will create a new AviSession. In avisession.go line 365 the library usesInsecureSkipVerify: true
, when constructing a new http client. This completely ignores the value ofavess.insecure
, which is set a few lines above (line 321) or by the options in line 326.The only way to get a secure http client (inside the AVI session) is to construct the http client first and set it via the options mechanism, by using the following code:
Apart from being more work than using a secure default setup, it is surprising for the user, as there is a
session.SetInsecure
option (and nosession.SetSecure
option), which wrongly implies, that the session is secure by default.Expected behaviour
By default a secure http client is created and used inside the AVI session, which can be configured to be insecure, when needed.
The text was updated successfully, but these errors were encountered: