Skip to content

hooks: Add option to disable TLS verification#1359

Open
nerg4l wants to merge 3 commits intotus:mainfrom
nerg4l:feat/hooks-http-insecure
Open

hooks: Add option to disable TLS verification#1359
nerg4l wants to merge 3 commits intotus:mainfrom
nerg4l:feat/hooks-http-insecure

Conversation

@nerg4l
Copy link
Copy Markdown

@nerg4l nerg4l commented Mar 30, 2026

This PR introduces hooks-http-insecure flag to the CLI and Insecure field to HttpHook struct.

If you are wondering, why ForceAttemptHTTP2: true, was added to http.Transport:

// InsecureSkipVerify controls whether a client verifies the server's
// certificate chain and host name. If InsecureSkipVerify is true, crypto/tls
// accepts any certificate presented by the server and any host name in that
// certificate. In this mode, TLS is susceptible to machine-in-the-middle
// attacks unless custom verification is used. This should be used only for
// testing or in combination with VerifyConnection or VerifyPeerCertificate.
InsecureSkipVerify bool

// ForceAttemptHTTP2 controls whether HTTP/2 is enabled when a non-zero
// Dial, DialTLS, or DialContext func or TLSClientConfig is provided.
// By default, use of any those fields conservatively disables HTTP/2.
// To use a custom dialer or TLS config and still attempt HTTP/2
// upgrades, set this to true.
ForceAttemptHTTP2 bool

Resolves #1335

Comment thread pkg/hooks/http/http.go Outdated
Comment thread pkg/hooks/http/http.go Outdated
Comment on lines +57 to +60
TLSClientConfig: &tls.Config{
InsecureSkipVerify: h.Insecure,
},
}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's do it like this, so we keep the default TLS config for most use cases:

Suggested change
TLSClientConfig: &tls.Config{
InsecureSkipVerify: h.Insecure,
},
}
}
if h.Insecure {
client.Transport.TLSClientConfig = &tls.Config{
InsecureSkipVerify: true,
}
}

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Transport is a http.RoundTripper and it would require casting like this. I changed the assignment a bit to avoid it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

‘skip verify’ flag for HTTP hooks

2 participants