aio-libs / aio-libs/aiohttp

Please provide a way for sysadmins to force use of an HTTP proxy server

Offen
#11,839 10 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
enhancement
Vorherrschende Sprache
Python
Sterne
16.5k
Forks
2.4k
Ø Merge
17 Std. 22 Min.
Gemergte PRs (30 T.)
212

Beschreibung

### Is your feature request related to a problem?

Dear everyone,

first let met thank you for creating this awesome library!

As a sysadmin, I would like to force processes using this library to use my proxy server. My goal is to limit outgoing connections to selected hosts, thereby blocking connections to hosts that might be used by malware in case of a compromised host.

Most other HTTP client libraries already support this by respecting environment variables like `https_proxy` and `no_proxy`. I noticed that aiohttp already supports these variables in theory, but it requires software developers to opt-in. However, software developers are not the people who know the environments the programs are run in. It is a decision that sysadmins ought to make.

Big and successful Python projects like Home Assistant or Music Assistant include a multitude of libraries embedding aiohttp. It is not feasible to patch each invocation of aiohttp's API to enable the use of proxy servers.

As a result, what I'm doing right now looks like this for a container running in Podman, but is a waste of resources if everybody first has to find out how to do it, because it can't be documented centrally:

```dockerfile
FROM ghcr.io/music-assistant/server:latest
RUN ["sh", "-c", "sed -e 's#trust_env: bool = False,#trust_env: bool = True,#' -i /app/venv/lib/python3.*/site-packages/aiohttp/client.py"]
```

Most people won't know how to inject a patch like that. Most people won't be able to increase security by using a proxy server with applications using aiohttp.

### Describe the solution you'd like

Please provide a means to let sysadmins express their wish to use proxy servers.

Options could be (non-exhaustive):
- Just enabling the already known environment variables as default values, if no other proxy settings were set in the API
- Using an additional variable (e. g. `AIOHTTP_TRUST_ENV=1`)´ to enable the variables for aiohttp.
- Using a configuration file for aiohttp or a flag visible inside the filesystem like `~/.aiohttp_trust_env`.

### Describe alternatives you've considered

Endless manual patching. ;-)

### Related component

Client

### Additional context

_No response_

### Code of Conduct

- [x] I agree to follow the aio-libs Code of Conduct

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.