Skip to content

Enforce TLS By Default #18

@ghost

Description

Currently hyper-tls will fall back to using HTTP if the URL passed to the connect function is not using the HTTPS scheme, this is probably not what people expect and it's not mentioned in the documentation anywhere as far as i can see. It might be worth erroring out if the URL scheme is not HTTPS by default in order to prevent people from unintentionally sending data in the clear when, for example, they don't control the URL passed into their application.

This would however be an API breaking change and i'm not sure if that is acceptable for the project right now. At the very least it would be nice to have an optional flag that forces the use of HTTPS, as well as mentioning this behaviour in the documentation so developers are aware of hyper-tls's default behaviour in situations where a URL using the HTTP scheme is used.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions