dapr / dapr/js-sdk

Have gRPC over SSL by default and enforce it

Open
#301 3 comments 2 reactions 0 assignees View on GitHub
enhancement triaged/resolved
Dominant language
JavaScript
Stars
217
Forks
104
PR merge metrics
No merged PRs in 30d

Description

## Describe the proposal

We should have best practices in the core of the SDK. People developing with it should have a speed-up in developer experience but also adhere to security practices.

gRPC in the ecosystem today always utilizes the `createInsecure()` method which creates an unencrypted channel and exposes channel credentials. (more: https://www.trendmicro.com/en_us/research/20/h/how-unsecure-grpc-implementations-can-compromise-apis.html)

We should switch to utilizing `createSsl()` for several reason, but the main ones being:

* It is required for #219 (we cannot have metadata in the `createFromMetadataGenerator` if we are not using an Ssl Channel)
* It's secure

Extra info can be found here as well: https://github.com/wechaty/puppet-service/issues/124 and https://github.com/wechaty/puppet-service/pull/159/files

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.