Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix verify ssl on windows, add option for anonymous auth #3313

Merged
merged 1 commit into from
Feb 25, 2025

Conversation

sbiscigl
Copy link
Contributor

Issue #, if available:

#3008

Description of changes:

We made a previous change to disable TLS when verify ssl was set to false. This was the incorrect behavior, we should try to use TLS but ignore certificate errors. This reverts that behavior changes and adds additional SSL verifications to ignore.

This adds another change that should have been the first fix, which is to allow for anonymous auth which is what the change was initially made to address #1445. the optional as stated by the microsoft docs

When the server requests a client certificate, WinHttpSendRequest, or WinHttpReceiveResponse returns an ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED error. If the server requests the certificate but doesn't require it, the application can specify this option to indicate that it doesn't have a certificate. The server can choose another authentication scheme or allow anonymous access to the server. The application provides the WINHTTP_NO_CLIENT_CERT_CONTEXT macro in the lpBuffer parameter of WinHttpSetOption as shown in the following code example.

This allowed for the basic auth as seen by the original opensearch example

#include <aws/core/Aws.h>
#include <aws/core/http/HttpClient.h>
#include <aws/core/utils/HashingUtils.h>

using namespace Aws;

auto main() -> int {
    SDKOptions options;
    options.loggingOptions.logLevel = Utils::Logging::LogLevel::Trace;
    InitAPI(options); {
        // Set client configuration
        Client::ClientConfiguration config;
        config. windowsHttpOptions. useAnonmousAuth = true
        config.verifySSL = false;

        const auto client = Aws::Http::CreateHttpClient(config);

        // Generate http request
        const auto request = CreateHttpRequest(
          String("https://localhost:9200/_cat/plugins?format=json"),
          Http::HttpMethod::HTTP_GET,
          Utils::Stream::DefaultResponseStreamFactoryMethod);

        // Set Authentication
        std::string authString = "admin:admin";
        Utils::Array<unsigned char> userpw_arr(reinterpret_cast<const unsigned char *>(authString.c_str()),authString.length());
        const auto basicAuth = Utils::HashingUtils::Base64Encode(userpw_arr);
        request->SetAuthorization("Basic " + basicAuth);

        // Issue request
        const auto response = client->MakeRequest(request);
        //assert(response->GetResponseCode() == Http::HttpResponseCode::OK);
        std::stringstream ss;
        ss << response->GetResponseBody().rdbuf();
        std::cout << ss.str() << "\n";
    }
    ShutdownAPI(options);
    return 0;
}

As stated before you likely should not be turning off verify ssl or using basic credentials unless explicitly using a development environment.

Check all that applies:

  • Did a review by yourself.
  • Added proper tests to cover this PR. (If tests are not applicable, explain.)
  • Checked if this PR is a breaking (APIs have been changed) change.
  • Checked if this PR will not introduce cross-platform inconsistent behavior.
  • Checked if this PR would require a ReadMe/Wiki update.

Check which platforms you have built SDK on to verify the correctness of this PR.

  • Linux
  • Windows
  • Android
  • MacOS
  • IOS
  • Other Platforms

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

* to a service, specifically only useful when disabling ssl verification and using
* a different type of authentication.
*/
bool useAnonmousAuth = false;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo: useAnonmousAuth
also it is WinHTTP not WindowsHTTP

the rest looks good.

@sbiscigl sbiscigl marked this pull request as ready for review February 25, 2025 18:03
@sbiscigl sbiscigl merged commit 6177ced into main Feb 25, 2025
3 of 4 checks passed
@sbiscigl sbiscigl deleted the windows-verify-ssl branch February 25, 2025 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants