grpc / grpc/grpc-node

Support gRPC-over-HTTPS using HTTPS proxy.

Open
#1,295 9 comments 0 reactions 0 assignees View on GitHub
feature request package: @grpc/grpc-js
Dominant language
TypeScript
Stars
4.8k
Forks
716
Avg merge
2d 3h
Merged PRs (30d)
10

Description

PR #1243 introduced proxy support allowing for gRPC-over-HTTP, i.e. an unencrypted proxy. While gRPC is encrypted by means of HTTP/2, and remains so when tunneled, the initial connection to the proxy is not. See https://github.com/grpc/grpc-node/blob/%40grpc/grpc-js%400.7.0/packages/grpc-js/src/http_proxy.ts#L133-L145

The initial HTTP `CONNECT` call contains two pieces of potentially private/secret data:
- The intended host to proxy
- The username/password when using an authenticated proxy

For these reasons it may be desirable to encrypt the `CONNECT` traffic via HTTPS.

Additionally, the current implementation ignores the protocol defined in the proxy configuration (only `PROXY_INFO.address` is used). When `https` is defined, this client will _still attempt_ to connect over `http`. If the proxy is expecting to negotiate TLS on the defined port (`URL.host`), it will error unexpectedly.

### Solution
Detect the presence of HTTP or HTTPS via `URL.protocol` and make the `CONNECT` request accordingly:
```ts
// pseudo-code
import * as http from 'http';
import * as https from 'https';

interface ProxyInfo {
address?: string;
creds?: string;
protocol?: string;
}

const schemeLib = PROXY_INFO.protocol === 'http' ? http : https; // secure by default
const request = schemeLib.request(options);
request.once('connect', (res, socket, head) => {/*...*/});
```

### Alternative
Be explicit about the lack of HTTPS support by both documenting, and detecting the usage of HTTPS and subsequently throwing an informative error.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.