Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gclient: changing the default behavior to require TLS certificate verification #3678

Closed
nyxfqq opened this issue Jul 6, 2024 · 0 comments
Closed

Comments

@nyxfqq
Copy link

nyxfqq commented Jul 6, 2024

Description

Currently, the GHTTP client in our project is configured by default to skip TLS certificate verification. This default setting undermines security by exposing connections to potential man-in-the-middle attacks and compromising data integrity.

I propose changing the default behavior to require TLS certificate verification. This enhancement ensures secure, encrypted, and authenticated communications. For development flexibility, an explicit configuration option should be added to selectively disable verification when necessary.

Additional

No response

@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Aug 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant