Have gRPC over SSL by default and enforce it
- Dominant language
- JavaScript
- Stars
- 217
- Forks
- 104
- PR merge metrics
- No merged PRs in 30d
Description
## Describe the proposal
We should have best practices in the core of the SDK. People developing with it should have a speed-up in developer experience but also adhere to security practices.
gRPC in the ecosystem today always utilizes the `createInsecure()` method which creates an unencrypted channel and exposes channel credentials. (more: https://www.trendmicro.com/en_us/research/20/h/how-unsecure-grpc-implementations-can-compromise-apis.html)
We should switch to utilizing `createSsl()` for several reason, but the main ones being:
* It is required for #219 (we cannot have metadata in the `createFromMetadataGenerator` if we are not using an Ssl Channel)
* It's secure
Extra info can be found here as well: https://github.com/wechaty/puppet-service/issues/124 and https://github.com/wechaty/puppet-service/pull/159/files
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.