[Feature]: Provide an option to disable SSL for REST APIs

appsmithorg / appsmith

Platform to build admin panels, internal tools, and dashboards. Integrates with 25+ databases and any API.

https://www.appsmith.com

Apache License 2.0

32.28k stars 3.5k forks source link

[Feature]: Provide an option to disable SSL for REST APIs #16889

Open pranavkanade opened 1 year ago

pranavkanade commented 1 year ago

Is there an existing issue for this?

[X] I have searched the existing issues

Summary

A user wants a config that can enable/disable SSL verification on per request / per Datasource basis. We've had a couple of instances of such a feature. Postman offers it through their setting panel - https://learning.postman.com/docs/sending-requests/certificates/#troubleshooting-certificate-errors

Why should this be worked on?

Requested by a couple of users on the intercom. Internal discussion - https://theappsmith.slack.com/archives/C0341RERY4R/p1663655448967439?thread_ts=1663581064.669149&cid=C0341RERY4R

Front conversations

manikumarnune123 commented 1 year ago

It would be good to have this feature instead of ssl check. Maybe an environment variable where the user can set true/false flag to start java with/without ssl.

rohan-arthur commented 1 year ago

@manikumarnune123 thank you for this feature request. On the one hand, this can be a field exposed on the REST datasource form, which will be a design-time decision. On the other, your comment indicates that you might want a runtime configuration possible. Can you explain your use case please?

svenkirsten commented 10 months ago

I need also this mandatory feature. All other RestAPI Tools like curl or postman are able to switch off the certification validation. To make it for this testing moment insecure. In my use case I need to talk to a storage system via REST. SSL certificate is always not valid.

amkungu commented 3 weeks ago

I work with voip engines and sometimes we need to disable this feature as we do on postman. some legacy systems though the offer restapi do not provide a straight forward solution for ssl and we normaly disable the same... this is a deal breaker for us...