secure outgoing http client with max connections #3508
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
woutslakhorst
requested review from
reinkrul,
gerardsn and
stevenvegt
as code owners
gerardsn
approved these changes
Oct 22, 2024
| // DefaultMaxHttpResponseSize is a default maximum size of an HTTP response body that will be read. | ||
| // Very large or unbounded HTTP responses can cause denial-of-service, so it's good to limit how much data is read. | ||
| // This of course heavily depends on the use case, but 1MB is a reasonable default. | ||
| const DefaultMaxHttpResponseSize = 1024 * 1024 |
There was a problem hiding this comment.
Would be nice if this is configurable
| @@ -219,6 +219,7 @@ func (b *denylistImpl) Subscribe(f func()) { | |||
| // download retrieves and parses the denylist | |||
| func (b *denylistImpl) download() ([]byte, error) { | |||
| // Make an HTTP GET request for the denylist URL | |||
| // We do not use our safe http client here since we're downloading from our own resource | |||
There was a problem hiding this comment.
download is from a configurable endpoint. (hidden config flag though)
Probably doesn't matter since it is a trusted endpoint.
| // The result HTTPRequestDoer can be supplied to OpenAPI generated clients for executing requests. | ||
| // This does not use the generated client options for e.g. authentication, | ||
| // because each generated OpenAPI client reimplements the client options using structs, | ||
| // which makes them incompatible with each other, making it impossible to use write generic client code for common traits like authorization. | ||
| // If the given authorization token builder is non-nil, it calls it and passes the resulting token as bearer token with requests. | ||
| func CreateHTTPClient(cfg ClientConfig, generator AuthorizationTokenGenerator) (HTTPRequestDoer, error) { | ||
| func CreateHTTPInternalClient(cfg ClientConfig, generator AuthorizationTokenGenerator) (HTTPRequestDoer, error) { |
There was a problem hiding this comment.
a bit weird that this is under core and all the other under http like the rest. Import cycle on config?
There was a problem hiding this comment.
these are for our commands, the other are outgoing.
Co-authored-by: Gerard Snaauw <[email protected]>
Co-authored-by: Gerard Snaauw <[email protected]>
rolandgroen
added a commit
that referenced
this pull request
Nov 1, 2024
* master: (72 commits) PKI add ValidateStrict (#3531) PEX: Return capture group for matched patterns (#3526) Schedule CodeQL twice a week (#3525) change cron schedule (#3524) Add gh action for CodeQL schedule (#3523) Bump github.com/lestrrat-go/jwx/v2 from 2.1.1 to 2.1.2 (#3520) docs: v6 release date (#3519) status codes for discovery client (#3513) Require SQL connection string in strictmode (#3517) Fix duplicate discovery results (#3515) Bump github.com/chromedp/chromedp from 0.11.0 to 0.11.1 (#3514) fix duplicate search results for wildcard param (#3512) Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys (#3511) remove network migration and optimize network event retry (#3510) secure outgoing http client with max connections (#3508) make gen-mocks (#3509) Bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.15.0 to 1.16.0 (#3506) fix invalid keyReference migration objects (#3504) Bump go.uber.org/mock from 0.4.0 to 0.5.0 (#3507) Bump github.com/nats-io/nats-server/v2 from 2.10.21 to 2.10.22 (#3505) ... # Conflicts: # vcr/test.go # vdr/legacy_integration_test.go # vdr/vdr.go # vdr/vdr_test.go
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes outcome from Elevation Of Privilege.
checked all creations of
http.Clientand replaced withclient.New,client.NewWithCacheorclient.NewWithTLSConfig.Also connected the limitreader to the strictClient.