[erlang-questions] What lib to use for http requests

[Drew Varner]

Benoit,

Nice. Is there any CRL or OCSP integration implemented or planned?

Cheers,
Drew



> On Dec 14, 2014, at 4:24 PM, Benoit Chesneau <bchesneau@REDACTED> wrote:
> 
> 
> 
>> On Fri, Dec 12, 2014 at 10:18 PM, Drew Varner <drew.varner@REDACTED> wrote:
>> Mark,
>> 
>> If you are communicating to servers via HTTPS, Hackney and other HTTP clients allow you to pass options to the underlying SSL/TLS socket, including some verification of the peer certificate. For example:
>> 
>> https://github.com/talko/httpcbench/blob/master/src/httpcbench_client.erl#L79-L86
>> 
>> Gun has an open issue to address this (https://github.com/extend/gun/pull/27), but it is not implemented. If you use Gun as your HTTPS client, you’re open to man-in-the-middle attacks.
>> 
>> Do not fall into a false sense of security that any Erlang HTTPS clients provide complete protection against man-in-the-middle attacks out of the box. You’ll also want to consider cases where your peer certificate was revoked by a Certificate Authority. You’d want to know how your HTTPS client handles certificates when their revocation data has been published via a CRL or OCSP. CRL verification has made some headway in Erlang (see the ssl module docs and https://github.com/Vagabond/erl_crl_example). You’ll also want to look at hostname verification (https://github.com/deadtrickster/ssl_verify_hostname.erl). 
>> 
>> HTTPS is as secure as you make it.
> 
> 
> Just  to expand a little bit, now  on latest stable erlang versions  of SSL hackney 1.0.x is by default checking SSL certificates and their hostname.
> 
> - benoit
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://erlang.org/pipermail/erlang-questions/attachments/20141214/bb2a3341/attachment.htm>