ducaale / xh

Friendly and fast tool for sending HTTP requests
MIT License
4.96k stars 90 forks source link

Apply TLS options even for non-HTTPS URLs #372

Closed blyxxyz closed 4 weeks ago

blyxxyz commented 1 month ago

TLS-related options were only being applied for URLs with a https:// scheme. But that's too cautious, because we could run into a HTTPS URL after a redirect.

I've fixed this by just removing the check. Another option is to also check args.follow, but I think it's nicer to do this stuff unconditionally. That way we can consistently give errors for bad options (e.g. --verify=path/wiht/typo).

Test case:

xh --verify=no --follow http://httpbin.org/redirect-to url==https://expired.badssl.com

Fixes #368.