Lightning.AuthProviders.TLS (Lightning v2.19.0-pre)

View Source

Shared TLS settings for the OIDC login fetches (discovery, JWKS, userinfo).

These endpoints supply or carry the material used to authenticate an SSO login, so they must be fetched over verified HTTPS: a MITM on any of them would let an attacker substitute keys/claims and forge a login.

Summary

Functions

secure_url?(url)

True when the URL is https, so verify_opts/0 actually applies.

verify_opts()

HTTPoison :ssl options that verify the server's certificate chain.

Functions

secure_url?(url)

True when the URL is https, so verify_opts/0 actually applies.

Plaintext http over a loopback host is accepted only when :auth_providers_allow_insecure_loopback is set (the test suite serves these endpoints over http on localhost); in production it is refused, so a misconfigured plaintext endpoint can't silently skip chain verification.

verify_opts()

HTTPoison :ssl options that verify the server's certificate chain.