snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/pkg/http/default.go

@@ -0,0 +1,34 @@
+package http
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"time"
+)
+
+// SetupDefaults Reconfigures defaults for  HTTP client & transport
+func SetupDefaults(timeout time.Duration, tlsInsecure bool) {
+	if tlsInsecure {
+		// This will allow HTTPS requests to insecure hosts (expired, wrong host, self signed, untrusted root...)
+		// With this enabled, features like OIDC auto-discovery should work on any of examples found on badssl.com.
+		//
+		// With SYSTEM_HTTP_CLIENT_TSL_INSECURE=0 (default) next command returns 404 error (expected)
+		// > ./system external-auth auto-discovery foo-tls-1 https://expired.badssl.com/
+		//
+		// Without SYSTEM_HTTP_CLIENT_TSL_INSECURE=1 next command returns "x509: certificate has expired or is not yet valid"
+		// > ./system external-auth auto-discovery foo-tls-1 https://expired.badssl.com/
+		//
+		http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+		http.DefaultTransport.(*http.Transport).DialContext = (&net.Dialer{Timeout: timeout}).DialContext
+		http.DefaultTransport.(*http.Transport).TLSHandshakeTimeout = timeout
+	}
+
+	if timeout > 0 {
+		http.DefaultClient.Timeout = timeout
+	}
+
+	http.DefaultClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		return http.ErrUseLastResponse
+	}
+}