-
Notifications
You must be signed in to change notification settings - Fork 4.1k
server: Bad UX if you try connecting to an insecure server over HTTPS #13008
Copy link
Copy link
Closed
Labels
A-kv-serverRelating to the KV-level RPC serverRelating to the KV-level RPC serverC-enhancementSolution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)S-3-ux-surpriseIssue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption.Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption.
Description
If a server is running in insecure mode, its admin UI is exposed as an HTTP endpoint, not HTTPS. That's great, but what isn't great is what happens if you try to access such a server's admin UI (or debug pages) over HTTPS (as shown below).
Would it be possible for us to return an HTTP 308 redirect like we do when you try to access a secure server over HTTP?
On Ubuntu:
$ curl -k https://localhost:8080
curl: (35) gnutls_handshake() failed: An unexpected TLS packet was received.
On OS X:
$ curl -k https://localhost:8080
curl: (35) Unknown SSL protocol error in connection to localhost:-9847
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
A-kv-serverRelating to the KV-level RPC serverRelating to the KV-level RPC serverC-enhancementSolution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)S-3-ux-surpriseIssue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption.Issue leaves users wondering whether CRDB is behaving properly. Likely to hurt reputation/adoption.
