-
-
Notifications
You must be signed in to change notification settings - Fork 98
Description
Currently hyper-tls will fall back to using HTTP if the URL passed to the connect function is not using the HTTPS scheme, this is probably not what people expect and it's not mentioned in the documentation anywhere as far as i can see. It might be worth erroring out if the URL scheme is not HTTPS by default in order to prevent people from unintentionally sending data in the clear when, for example, they don't control the URL passed into their application.
This would however be an API breaking change and i'm not sure if that is acceptable for the project right now. At the very least it would be nice to have an optional flag that forces the use of HTTPS, as well as mentioning this behaviour in the documentation so developers are aware of hyper-tls's default behaviour in situations where a URL using the HTTP scheme is used.