proposal: net/http: add GO_SKIP_TLS_CHECK

[droopy4096]

for debugging purposes it is often beneficial to have ability to disable strict TLS checks temporarily. Adding something like GO_SKIP_TLS_CHECK environment variable to disable strict checking (akin to curl's -k switch) would help a lot when dealing with quite a few 3rd party components. Also useful when using MITM proxies. Since #18733 has not moved forward it would be nice to have some means to troubleshoot existing app stacks

[droopy4096]

related issue: #19215

[ianlancetaylor]

CC @neild @bradfitz

If I understand this correctly, setting this environment variable would make all net/http connections insecure even if they appeared to be secure. That's a pretty broad scope for security attacks. It doesn't sound like a good idea to make it quite that easy to make all Go programs that use net/http less secure.

That said, if we do use an environment variable, it should be GODEBUG, a variable that we already use.

But better than an environment variable might be some sort of programmatic option somewhere. Then at least the insecurity would be limited to a program that uses that feature, rather than all Go programs that use net/http.

[neild]

You can disable certificate verification by setting tls.Config.InsecureSkipVerify. I believe this matches the effect of curl's -k flag on TLS connections.

I don't think we'd want to support an environment variable that disables TLS validation; that seems tremendously risky. It's simple enough to wire up an environment variable to InsecureSkipVerify in user code if you want that behavior.

[ianlancetaylor]

Thanks. I'm going to preemptively close this proposal. I don't see any way that we would do this. Please comment if you disagree.