3 ms·
The client-side library should disable HTTP by default to ensure that raw data never leaves the local environment, thereby avoiding any leakage.
by ChrisTorng 2y ago
The client-side library should disable HTTP by default to ensure that raw data never leaves the local environment, thereby avoiding any leakage.
- gpvos 2y agoIt should, but additional server-side mitigations are good for defense in depth. There may be people using a different client-side library, maybe because they use a different programming language.
- ljm 2y agoWhat about things like unencrypted websockets? Or raw TCP/UDP connections?
- rattray 2y ago(I develop client SDKS) It could make sense for first-party SDKs for an API to block http access to the first-party API domain, but that should be unnecessary – typically users would use the default base URL hardcoded in the client library, and only replace it if they're going through some other proxy. When they _do_ go through some other proxy, it's commonly in an internal network of some kind, where http is appropriate and should not be blocked.