Skip to content

Don't create insecure clients by default #3015

Open
@FSchumacher

Description

@FSchumacher

Problem

client.NewAviClient generates clients, that are insecure by default

Description

Calling NewAviSession will create a new AviSession. In avisession.go line 365 the library uses InsecureSkipVerify: true, when constructing a new http client. This completely ignores the value of avess.insecure, which is set a few lines above (line 321) or by the options in line 326.

The only way to get a secure http client (inside the AVI session) is to construct the http client first and set it via the options mechanism, by using the following code:

tlsConfig := tls.Config{
	InsecureSkipVerify: false,
}
httpClient := &http.Client{Transport: &http.Transport{TLSClientConfig: &tlsConfig}}

client, err := clients.NewAviClient(apiEndpoint, apiUser, session.setClient(httpClient)) 

Apart from being more work than using a secure default setup, it is surprising for the user, as there is a session.SetInsecure option (and no session.SetSecure option), which wrongly implies, that the session is secure by default.

Expected behaviour

By default a secure http client is created and used inside the AVI session, which can be configured to be insecure, when needed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions