pjfanning opened a new pull request, #820:
URL: https://github.com/apache/pekko-grpc/pull/820
Problem
The Pekko HTTP client backend (PekkoHttpClientUtils) never called
setEndpointIdentificationAlgorithm("HTTPS") on the SSLEngine. This meant no RFC
2818 hostname verification — the client would accept any valid certificate
regardless of hostname, enabling MitM attacks. The Netty backend was not
affected (gRPC-shaded Netty verifies by default).
Solution: Opt-in config with warning
reference.conf — new config key:
hocon
```
verify-hostname = false
```
Default is false (preserves existing behavior). The warning in the log
nudges users toward enabling it.
GrpcClientSettings — new field and setter:
- verifyHostname: Boolean — read from config
- withVerifyHostname(value: Boolean) — programmatic override
PekkoHttpClientUtils — conditional verification:
- When verifyHostname = true: sets
setEndpointIdentificationAlgorithm("HTTPS") on the SSLEngine, enabling hostname
checking
- When verifyHostname = false: skips the setting (existing behavior), logs a
warning once per channel creation:
▎ TLS hostname verification is disabled for pekko-http client 'X'. This is
insecure and should only be used for testing. Enable it with verify-hostname =
true in your configuration. Note: the netty backend always verifies hostnames.
Usage
hocon
```
pekko.grpc.client."*" {
verify-hostname = true
}
```
Or programmatically:
```
val settings = GrpcClientSettings.connectToServiceAt("localhost", 8080)
.withVerifyHostname(true)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
