fix: grpc client, allow insecure only in dev

mklos-kw · mklos-kw · commit c55cc70aaaca · 2025-08-07T12:17:12.000+02:00
diff --git a/ocis-pkg/service/grpc/client.go b/ocis-pkg/service/grpc/client.go
@@ -74,6 +74,9 @@ func NewClient(opts ...ClientOption) (client.Client, error) {
 	}
 	switch options.tlsMode {
 	case "insecure":
+		if os.Getenv("OCIS_INSECURE") != "true" {
+			return nil, errors.New("insecure TLS mode is only allowed in development environments with OCIS_INSECURE=true")
+		}
 		tlsConfig = &tls.Config{
 			InsecureSkipVerify: true,
 		}

Original file line number	Diff line number	Diff line change
`@@ -74,6 +74,9 @@ func NewClient(opts ...ClientOption) (client.Client, error) {`
`74`	`74`	`}`
`75`	`75`	`switch options.tlsMode {`
`76`	`76`	`case "insecure":`
	`77`	`+ if os.Getenv("OCIS_INSECURE") != "true" {`
	`78`	`+ return nil, errors.New("insecure TLS mode is only allowed in development environments with OCIS_INSECURE=true")`
	`79`	`+ }`
`77`	`80`	`tlsConfig = &tls.Config{`
`78`	`81`	`InsecureSkipVerify: true,`
`79`	`82`	`}`