[TC-004] Remove insecure (-k) option from curl commands to not skip SSL cert verification#3678
Conversation
🧪 Unit Test Results📊 Summary
Last updated: Mon, 04 May 2026 14:12:52 GMT |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: Remove -k (insecure) flag from curl commands
Overview
This PR removes the -k / --insecure flag from three curl invocations in apps/postProcessTestRun.bash. This flag disables SSL/TLS certificate verification, which means curl previously accepted any certificate (expired, self-signed, or from an untrusted CA) without complaint — a classic vector for man-in-the-middle attacks. Removing it restores proper certificate validation for outbound requests to the Observe telemetry endpoint.
Assessment
This is a clean, focused, and correct security fix. No logic is changed — only the TLS enforcement posture is corrected.
Checklist
- Missing trailing newline (
apps/postProcessTestRun.bash, line 162) — the file still lacks a POSIX-required trailing newline (see inline comment).
Positive Notes
- Removing
-kis the right call. The Observe endpoint (observeinc.com) uses a publicly trusted certificate, so this will work correctly without the flag. - The bearer token is still passed via
$OBSERVE_MOBILE_TOKEN(environment variable), not hardcoded — good practice. - All three curl call sites are consistently updated, so there are no stragglers left using the insecure flag.
| curl -k "https://103443579803.collect.observeinc.com/v1/http" -H "Authorization: Bearer $OBSERVE_MOBILE_TOKEN" -H "Content-Type: application/json" -d "$payload" | ||
| curl "https://103443579803.collect.observeinc.com/v1/http" -H "Authorization: Bearer $OBSERVE_MOBILE_TOKEN" -H "Content-Type: application/json" -d "$payload" | ||
| fi | ||
| done < "$costFile" No newline at end of file |
There was a problem hiding this comment.
The file is missing a trailing newline. POSIX requires text files to end with a newline, and many tools (linters, git diff, wc -l) behave unexpectedly without one. A simple fix is to add a blank line after this last line.
📊 Code Coverage Report✅ Student
✅ Teacher
✅ Pandautils
📈 Overall Average
|
2 participants
-k was unnecessarily skipped the SSL cert verification.