Skip to content

fix: Service utilize httputil.SafeHttpClient #1926

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 5, 2025

Conversation

jentfoo
Copy link
Contributor

@jentfoo jentfoo commented Feb 18, 2025

Proposed Changes

This PR follows #1910 by updating service to utilize the new httputil helper for constructing a client which wont follow redirects, and has sensible timeouts. To quote that description:

This change switches us from maintaining a tls config which we then on-demand initialize an http.Client with to instead maintain and reuse an http.Client instance. This enables us to utilize the connection pooling which occurs within the http.Transport to reduce ssl handshakes and thus reduce latency.

In addition this change provides us a central place to configure out http.Client (httputil). Allowing us to easily set configuration options to reduce the security risks of using an unconfigured http.Client. Notably timeouts to reduce DoS risks, and control around following redirects to prevent blind SSRF's.

The prior auth API was marked as deprecated. There is no remaining use within this repo, so it may be able to be removed.

Merging this should fully resolve #1891.

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@jentfoo jentfoo self-assigned this Feb 18, 2025
@jentfoo jentfoo requested review from a team as code owners February 18, 2025 22:52
@jentfoo jentfoo marked this pull request as draft February 18, 2025 22:57
This PR follows #1910 by updating `service` to utilize the new `httputil` helper for constructing a client which wont follow redirects, and has sensible timeouts.

The prior auth API was marked as deprecated. There is no remaining use within this repo, so it may be able to be removed.

Merging this should fully resolve #1891.
@jentfoo jentfoo force-pushed the jent/http.Client_handling branch from f6d0965 to 25dede0 Compare March 5, 2025 17:57
@jentfoo jentfoo marked this pull request as ready for review March 5, 2025 18:27
@jentfoo jentfoo added this pull request to the merge queue Mar 5, 2025
Merged via the queue into main with commit af32700 Mar 5, 2025
22 checks passed
@jentfoo jentfoo deleted the jent/http.Client_handling branch March 5, 2025 19:19
github-merge-queue bot pushed a commit that referenced this pull request Mar 10, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.3.29](sdk/v0.3.28...sdk/v0.3.29)
(2025-03-08)


### Bug Fixes

* **core:** Autobump sdk
([#1968](#1968))
([7084061](7084061))
* **core:** Autobump sdk
([#1972](#1972))
([7258f5d](7258f5d))
* **core:** Updates ec-wrapped to newer salt
([#1961](#1961))
([0e17968](0e17968))
* Service utilize `httputil.SafeHttpClient`
([#1926](#1926))
([af32700](af32700))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
github-merge-queue bot pushed a commit that referenced this pull request Mar 11, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.4.40](service/v0.4.39...service/v0.4.40)
(2025-03-10)


### Bug Fixes

* **core:** Autobump service
([#1970](#1970))
([c0bbb11](c0bbb11))
* **core:** Autobump service
([#1976](#1976))
([c79fe0d](c79fe0d))
* **core:** Fixes merge fail in bulk logic
([#1966](#1966))
([c93bf62](c93bf62))
* **policy:** remove new public keys rpc's
([#1962](#1962))
([5049bab](5049bab))
* Service utilize `httputil.SafeHttpClient`
([#1926](#1926))
([af32700](af32700))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve http.Client usage
3 participants