[
https://issues.apache.org/jira/browse/THRIFT-6282?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6282.
--------------------------------
Fix Version/s: 0.25.0
Assignee: Jens Geyer
Resolution: Fixed
> Erlang: let the HTTP transport use https
> ----------------------------------------
>
> Key: THRIFT-6282
> URL: https://issues.apache.org/jira/browse/THRIFT-6282
> Project: Thrift
> Issue Type: Sub-task
> Components: Erlang - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Minor
> Fix For: 0.25.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Split out of THRIFT-6268 (second point). The first point, a failed request,
> is PR #3866.
> {{thrift_http_transport}} builds its request URL as {{"http://"; ++ Host ++
> Path}}, so a client cannot reach an endpoint that only speaks TLS.
> h2. What httpc does with TLS by default
> Measured against a local TLS server with the self-signed certificate from
> {{test/keys}}, with no {{ssl}} options given:
> * OTP 25.3: the request succeeds; httpc only logs "Server authenticity is not
> verified since certificate path validation is not enabled". Its default TLS
> option list is empty.
> * OTP 26, 27, 28: the request is refused ({{selfsigned_peer}}); httpc
> defaults to {{httpc:ssl_verify_host_options(true)}}.
> h2. Suggested
> * An option for {{thrift_http_transport:new/3}} that selects https, with http
> staying the default.
> * TLS options keep coming through {{http_options}}, where httpc takes them.
> * When the caller gives no TLS options for https, the transport passes
> {{httpc:ssl_verify_host_options(true)}} itself, so that the certificate is
> checked on OTP 25 as well.
> * Tests against a local TLS server: a trusted certificate connects; an
> untrusted certificate and a wrong host name are refused, on every OTP release
> in the CI matrix.
> _Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens
> Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
