This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko-grpc.git
The following commit(s) were added to refs/heads/main by this push:
new bf041bbc Verify hostname defaulting to true (#830)
bf041bbc is described below
commit bf041bbcd138cf58e01ab70ba6aecf103733fba4
Author: PJ Fanning <[email protected]>
AuthorDate: Wed Aug 5 21:14:29 2026 +0100
Verify hostname defaulting to true (#830)
* change default for verify-hostname to true
* Update GrpcClientSettings.scala
---
runtime/src/main/resources/reference.conf | 6 +++---
.../src/main/scala/org/apache/pekko/grpc/GrpcClientSettings.scala | 4 ++--
.../scala/org/apache/pekko/grpc/internal/PekkoHttpClientUtils.scala | 2 +-
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/runtime/src/main/resources/reference.conf
b/runtime/src/main/resources/reference.conf
index 89a84f85..8aaecc39 100644
--- a/runtime/src/main/resources/reference.conf
+++ b/runtime/src/main/resources/reference.conf
@@ -39,10 +39,10 @@ pekko.grpc.client."*" {
ssl-provider = ""
# Whether to verify the server's hostname against its TLS certificate (RFC
2818).
- # When false (the default), the client accepts any valid certificate
regardless
- # of hostname. This is insecure for production and should only be used for
testing.
+ # When false, the client accepts any valid certificate regardless of
hostname.
+ # This is insecure and should only be used for testing.
# Only effective for the pekko-http backend; the netty backend always
verifies.
- verify-hostname = false
+ verify-hostname = true
# TODO: Enforce HTTP/2 TLS restrictions:
https://tools.ietf.org/html/draft-ietf-httpbis-http2-17#section-9.2
diff --git
a/runtime/src/main/scala/org/apache/pekko/grpc/GrpcClientSettings.scala
b/runtime/src/main/scala/org/apache/pekko/grpc/GrpcClientSettings.scala
index 16eb934b..24bd84c3 100644
--- a/runtime/src/main/scala/org/apache/pekko/grpc/GrpcClientSettings.scala
+++ b/runtime/src/main/scala/org/apache/pekko/grpc/GrpcClientSettings.scala
@@ -293,8 +293,8 @@ final class GrpcClientSettings private (
/**
* Whether to verify the server's hostname against its TLS certificate (RFC
2818).
- * When false (the default), the client accepts any valid certificate
regardless
- * of hostname. This is insecure for production and should only be used for
testing.
+ * When false, the client accepts any valid certificate regardless of
hostname.
+ * This is insecure and should only be used for testing.
* Only effective for the pekko-http backend; the netty backend always
verifies.
* @since 2.0.0
*/
diff --git
a/runtime/src/main/scala/org/apache/pekko/grpc/internal/PekkoHttpClientUtils.scala
b/runtime/src/main/scala/org/apache/pekko/grpc/internal/PekkoHttpClientUtils.scala
index f4fe196e..c4548ed4 100644
---
a/runtime/src/main/scala/org/apache/pekko/grpc/internal/PekkoHttpClientUtils.scala
+++
b/runtime/src/main/scala/org/apache/pekko/grpc/internal/PekkoHttpClientUtils.scala
@@ -100,7 +100,7 @@ object PekkoHttpClientUtils {
log.warning(
"TLS hostname verification is disabled for pekko-http client '{}'.
" +
"This is insecure and should only be used for testing. " +
- "Enable it with verify-hostname = true in your configuration. " +
+ "Set verify-hostname = true in your configuration (now the
default). " +
"Note: the netty backend always verifies hostnames.",
settings.serviceName)
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
