Skip to content

Cannot create a credential for a Connect server that redirects http to https #4315

Description

@christierney

Problem

With a Connect server configured with [HTTPRedirect] (http://host:3939 redirects to https://host:3443), Add Credential fails no matter how the URL is entered when Verify TLS Certificates is disabled:

  • http://host:3939Error: Invalid URL (unable to validate connectivity with Server URL - Protocol "http:" not supported. Expected "https:".)
  • host:3939Error: Invalid URL (unable to validate connectivity with Server URL - Unable to reach the server. ...) (Publisher defaults to https, and a TLS handshake against the plain-HTTP port fails; this is expected — type the scheme explicitly)

Causes

  1. When certificate verification is disabled, the custom transport in @posit-dev/connect-api hard-codes https.request, so any http: URL fails with Node's ERR_INVALID_PROTOCOL. This also breaks all plain-http Connect servers when verification is disabled, redirect or not.
  2. That transport also does not follow redirects, so the http→https upgrade redirect can never be followed in insecure mode.
  3. Even in secure mode, where axios follows the redirect, the post-redirect URL is discarded — the credential is stored with the typed http:// URL, so every subsequent request (including ones carrying Authorization headers) first goes out over plaintext http.

Fix

  • Dispatch the insecure transport on the request protocol (http.request vs https.request).
  • Resolve redirects once, unauthenticated, while validating the server URL, and store the resolved (https) URL in the credential.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions