Remove SSL cert for localhost #374
Conversation
pinkwah
requested review from
anders-kiaer,
asnyv and
HansKallekleiv
as code owners
pinkwah
force-pushed
the
remove-cert
branch
2 times, most recently
from
a17196e to
178637f
Compare
|
The current changes are:
|
|
Is it safe to have force-https disabled also when not running |
|
In my experience, the web application runs behind a reverse proxy. My reasoning is that I know that you can specify/buy SSL keys on Azure, and then it doesn't make sense to have the webapp deal with HTTPS, but Azure magically know how to inject SSL keys into the black box that is your web program. I might be very wrong though, but I reckon this is something that needs to be brought up with security. FWIW, all of my web development experience comes from using Ruby on Rails, which could've been forcing HTTPS in a smart but transparent way that I've never noticed. |
pinkwah
force-pushed
the
remove-cert
branch
2 times, most recently
from
7ba8877 to
14681a2
Compare
webviz_config/command_line.py
Outdated
| @@ -175,3 +175,14 @@ def entrypoint_schema(args: argparse.Namespace) -> None: | |||
| args = parser.parse_args() | |||
|
|
|||
| args.func(args) | |||
|
|
|||
|
|
|||
| def _dummy_create_ca() -> None: | |||
There was a problem hiding this comment.
The set_defaults sends the arguments to the function, currently fails.
| def _dummy_create_ca() -> None: | |
| def _dummy_create_ca(_: argparse.Namespace) -> None: |
|
One thing to fix since |
|
Fixed. |
pinkwah
force-pushed
the
remove-cert
branch
3 times, most recently
from
1c4d86a to
5800d39
Compare
This commit removes SSL certification creation and usage when running webviz. The onus is on the process that connects to the internet to handle HTTPS, eg. Azure's firewall.
This PR removes SSL certification creation and usage when running webviz in localhost mode. This makes it HTTP-only for localhost with no HTTPS option.
It isn't complete in the sense that we still have to consider all cases. To my knowledge, the industry standard within web applications is to have the application (webviz) only do things using HTTP, and let a reverse proxy deal with HTTPS. I'm not entirely sure how this applies to Azure, but I imagine a similar thing is true there. That means that our use of
flask-talisman(the security hardening addon for Flask) should perhaps not be as strict.This should also be documented somehow. The workflow of our users depends on there existing certificates.
Resolves #332
Resolves equinor/webviz-ert#87