Skip to content

Don't create insecure clients by default #3015

Description

@FSchumacher

Problem

client.NewAviClient generates clients, that are insecure by default

Description

Calling NewAviSession will create a new AviSession. In avisession.go line 365 the library uses InsecureSkipVerify: true, when constructing a new http client. This completely ignores the value of avess.insecure, which is set a few lines above (line 321) or by the options in line 326.

The only way to get a secure http client (inside the AVI session) is to construct the http client first and set it via the options mechanism, by using the following code:

tlsConfig := tls.Config{
	InsecureSkipVerify: false,
}
httpClient := &http.Client{Transport: &http.Transport{TLSClientConfig: &tlsConfig}}

client, err := clients.NewAviClient(apiEndpoint, apiUser, session.setClient(httpClient)) 

Apart from being more work than using a secure default setup, it is surprising for the user, as there is a session.SetInsecure option (and no session.SetSecure option), which wrongly implies, that the session is secure by default.

Expected behaviour

By default a secure http client is created and used inside the AVI session, which can be configured to be insecure, when needed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions