nspcc-dev/neofs-sdk-go

Fork 0

mirror of https://github.com/nspcc-dev/neofs-sdk-go.git synced 2026-03-01 04:29:18 +00:00

Autoresolve `grpcs` scheme for port `443` #243

New issue

Open

opened 2025-12-28 18:07:32 +00:00 by sami · 6 comments

sami commented

2025-12-28 18:07:32 +00:00

Owner

Originally created by @cthulhu-rider on GitHub (Dec 4, 2024).

Client uses insecure grpc scheme when scheme is missing in the address parameter. Port 443 is reserved for http protocol over TLS/SSL. For users, it would be easier if conn scheme defaulted to grpcs for addresses with this port cuz it's easier to forget the scheme than desire to try dial it insecurely

Describe the solution you'd like

when port is 443, make a TLS dial

Describe alternatives you've considered

Additional context

https://github.com/nspcc-dev/neo-go/issues/3721

Originally created by @cthulhu-rider on GitHub (Dec 4, 2024). ## Is your feature request related to a problem? Please describe. `Client` uses insecure `grpc` scheme when scheme is missing in the address [parameter](https://pkg.go.dev/github.com/nspcc-dev/neofs-sdk-go/client#PrmDial.SetServerURI). Port `443` is [reserved](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=443) for `http protocol over TLS/SSL`. For users, it would be easier if conn scheme defaulted to `grpcs` for addresses with this port cuz it's easier to forget the scheme than desire to try dial it insecurely ## Describe the solution you'd like when port is `443`, make a TLS dial ## Describe alternatives you've considered no ## Additional context https://github.com/nspcc-dev/neo-go/issues/3721

sami added the

client

discussion

feature

labels

2025-12-28 18:07:32 +00:00

sami commented

2025-12-28 18:07:33 +00:00

Author

Owner

@roman-khimov commented on GitHub (Dec 4, 2024):

Really questionable. Admins can do all sorts of weird things. You don't know if 443 is TLS or not in any particular scenario. Normally it is. But some can find reasons to do otherwise. Schemes are exactly for that, http/https, grpc/grpcs. If we were talking about the default port when it's not specified, that'd be a different story, there are known good ones to use. But when it's specified without a scheme you have to resort to the default scheme which is not using TLS.

@roman-khimov commented on GitHub (Dec 4, 2024): Really questionable. Admins can do all sorts of weird things. You don't know if 443 is TLS or not in any particular scenario. Normally it is. But some can find reasons to do otherwise. Schemes are exactly for that, http/https, grpc/grpcs. If we were talking about the default port when it's not specified, that'd be a different story, there are known good ones to use. But when it's specified without a scheme you have to resort to the default scheme which is not using TLS.

sami commented

2025-12-28 18:07:33 +00:00

Author

Owner

@532910 commented on GitHub (Dec 5, 2024):

I'd prefer to have 443 as a default: grpcs://st1.storage.fs.neo.org

@532910 commented on GitHub (Dec 5, 2024): I'd prefer to have 443 as a default: grpcs://st1.storage.fs.neo.org

sami commented

2025-12-28 18:07:33 +00:00

Author

Owner

@cthulhu-rider commented on GitHub (Dec 5, 2024):

Normally it is.

exactly, this is where defaults fit well, which should make life easier in real practice

But some can find reasons to do otherwise.

ofc, but this is much more rare case tbh. For them, it is worth explicitly specifying the scheme

I'd prefer to have 443 as a default: grpcs://st1.storage.fs.neo.org

i like this too. In total, I'd expect following resolution:

host:443 -> grpcs://host:443
grpcs://host -> grpcs://host:443

this would cover most practical cases and reduce the likelihood of random mistake

i can also agree with @roman-khimov opinion cuz curl does not use HTTPS by default for 443

$ curl 157.90.176.145:443
<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>

browsers' behavior vary: Chrome uses HTTPS while Firefox does not

@cthulhu-rider commented on GitHub (Dec 5, 2024): > Normally it is. exactly, this is where defaults fit well, which should make life easier in real practice > But some can find reasons to do otherwise. ofc, but this is much more rare case tbh. For them, it is worth explicitly specifying the scheme > I'd prefer to have 443 as a default: grpcs://st1.storage.fs.neo.org i like this too. In total, I'd expect following resolution: - `host:443` -> `grpcs://host:443` - `grpcs://host` -> `grpcs://host:443` this would cover most practical cases and reduce the likelihood of random mistake --- i can also agree with @roman-khimov opinion cuz `curl` does not use HTTPS by default for 443 ``` $ curl 157.90.176.145:443 <html> <head><title>400 The plain HTTP request was sent to HTTPS port</title></head> <body> <center><h1>400 Bad Request</h1></center> ``` browsers' behavior vary: Chrome uses HTTPS while Firefox does not

sami commented

2025-12-28 18:07:33 +00:00

Author

Owner

@532910 commented on GitHub (Dec 5, 2024):

Firefox also uses https by default

@532910 commented on GitHub (Dec 5, 2024): Firefox also uses https by default

sami commented

2025-12-28 18:07:33 +00:00

Author

Owner

@cthulhu-rider commented on GitHub (Dec 6, 2024):