Repository navigation
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
reqwest uses a preconfigured rustls config as-is and only sets ALPN on configs it builds itself, so pinned requests always fell back to HTTP/1.1.
Pinning only trusted webpki-roots, so servers with a private or self-signed CA could never be pinned and apps lost OS roots.
The verifier encoded the failure as marker text in rustls::Error::General and map_transport_error searched the error chain's messages for it. Carry a typed error in rustls::Error::Other and downcast it instead.
validate looked up the URL host verbatim while pins and the verifier strip the trailing dot, so https://api.example.com./ was rejected as unpinned.
configure rebuilt the root store, WebPKI verifier and rustls config on every request. Build it on first use and reset it when a builder method changes the settings it depends on.
The README example used pins that fail to parse, and nothing told JS callers that extension errors reject fetch with a plain object.
…LOWED The https_only client stopped the redirect, but JS received reqwest's plain error string instead of the structured pinning error.
| mod spki_pinning; | ||
|
|
||
| #[cfg(feature = "spki-pinning")] | ||
| pub use rustls; |
There was a problem hiding this comment.
if rustls starts pumping out breaking changes i'll lose my fucking mind
| /// Configures the final request client after the plugin has applied its | ||
| /// timeout, redirect, proxy, cookie, and feature-gated TLS settings. |
There was a problem hiding this comment.
do we want some policy like on https://docs.rs/tauri/latest/tauri/webview/struct.WebviewWindow.html#method.with_webview so we can upgrade reqwest in minors?
Package Changes Through d7d55ceThere are 25 changes which include barcode-scanner with patch, barcode-scanner-js with patch, biometric with minor, biometric-js with minor, clipboard-manager with minor, clipboard-manager-js with minor, deep-link with patch, deep-link-js with patch, fs with patch, fs-js with patch, notification with minor, notification-js with minor, opener with patch, opener-js with patch, geolocation with minor, geolocation-js with minor, http with minor, http-js with minor, single-instance with patch, sql with minor, sql-js with minor, torch with minor, torch-js with minor, updater with minor, updater-js with minor Planned Package VersionsThe following package releases are the planned based on the context of changes in this pull request.
Add another change file through the GitHub UI by following this link. Read about change files or the docs at github.com/jbolda/covector |
|
ngl this (or rather #3538) feels so over-engineered 😅 a whole extentions system sounds like you actually want users to just use reqwest themselves at this point. |
4 participants
Motivation
Implements the SPKI pinning request from #3414 on top of the native transport extension API in the preceding PR.
The JavaScript fetch API remains unchanged. Pin configuration is native Rust code and cannot be disabled by frontend request options.
Security behavior
allow_unpinned_hosts()andallow_http()are explicit native opt-ins.API
The implementation is behind the optional
spki-pinningCargo feature, so applications that do not use it do not receive its Rustls, X.509, and hashing dependencies.Depends on #3538 and should be reviewed as a stacked change. The second commit contains the SPKI-specific delta; once #3538 merges, this PR automatically reduces to that commit.