mlxprs
mlxprs copied to clipboard
SSL connection misconfigurations give cryptic feedback to user
If the configuration sets SSL to true, but the app server is not configured for SSL, the error response is cryptic.
To reproduce, set up a server without SSL (vanilla DHF install is fine) and use settings:
/* mlxprs:settings
{
"host": "localhost",
"port": 8211,
"contentDb": "sled-mes-FINAL",
"modulesDb": "sled-mes-MODULES",
"ssl": true,
"authType": "digest",
"user": "admin",
"pwd": "admin"
}
*/
Response in results buffer is:
{
"errno": "EPROTO",
"code": "EPROTO",
"syscall": "write"
}
the popup error says:
write EPROTO 140497846915416:error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER:../../third_party/boringssl/src/ssl/tls_record.cc:242:\n"
ideal behavior would be to report that "an attempt was made to connect using SSL to an http server not configured with SSL" or similar.
For the reverse situation (ssl on server but ssl: false in config) the message
"message": "eval JavaScript on server: challenge request failed for /v1/eval",
is returned.
Better would be: "an attempt was made to connect without SSL to an http server configured to require SSL" or similar.