Jens Geyer created THRIFT-6282:
----------------------------------
Summary: Erlang: let the HTTP transport use https
Key: THRIFT-6282
URL: https://issues.apache.org/jira/browse/THRIFT-6282
Project: Thrift
Issue Type: Sub-task
Components: Erlang - Library
Reporter: Jens Geyer
Split out of THRIFT-6268 (second point). The first point, a failed request, is
PR #3866.
{{thrift_http_transport}} builds its request URL as {{"http://"; ++ Host ++
Path}}, so a client cannot reach an endpoint that only speaks TLS.
h2. What httpc does with TLS by default
Measured against a local TLS server with the self-signed certificate from
{{test/keys}}, with no {{ssl}} options given:
* OTP 25.3: the request succeeds; httpc only logs "Server authenticity is not
verified since certificate path validation is not enabled". Its default TLS
option list is empty.
* OTP 26, 27, 28: the request is refused ({{selfsigned_peer}}); httpc defaults
to {{httpc:ssl_verify_host_options(true)}}.
h2. Suggested
* An option for {{thrift_http_transport:new/3}} that selects https, with http
staying the default.
* TLS options keep coming through {{http_options}}, where httpc takes them.
* When the caller gives no TLS options for https, the transport passes
{{httpc:ssl_verify_host_options(true)}} itself, so that the certificate is
checked on OTP 25 as well.
* Tests against a local TLS server: a trusted certificate connects; an
untrusted certificate and a wrong host name are refused, on every OTP release
in the CI matrix.
_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
