mulesoft / osprey

Generate Node.JS API middleware from a RAML definition
Other
431 stars 66 forks source link

Proxy doesn't handle https correctly #128

Closed jenschude closed 7 years ago

jenschude commented 7 years ago

I'm using the RAML1.0 branch and having some issues with https.

When starting osprey in proxy mode to proxy a https address (e.g.: node bin/osprey.js -f api.raml -a https://api.example.org -p 3000). The proxy request is handled using the http engine. Somehow the proxyRequest options resolve the protocol to 'https:' instead of 'https' so in proxy.js

/**
 * Create the proxy request.
 *
 * @param  {Object}   opts
 * @param  {Stream}   writableStream
 * @param  {Function} cb
 * @return {Stream}
 */
function proxyRequest (opts, writableStream, errCb) {
  var engine = opts.protocol === 'https' ? https : http

  var proxy = engine.request(opts, function (response) {
    response.pipe(writableStream)
  })

  proxy.on('error', errCb)

  return proxy
}

this resolves to the http engine. By changing the line to var engine = opts.protocol === 'https:' ? https : http the issue is resolved, but maybe there are some other things to check.

The next issue is, that i have to disable the SSL verification using the environment variable NODE_TLS_REJECT_UNAUTHORIZED=0

Another annoyance is, that it's not directly possible to activate CORS headers or compression using the command line options. An option to add some server configuration would be a nice addition.

jstoiko commented 7 years ago

Thanks for reporting this.

Regarding your main issue, I was able to reproduce it. It was an old issue as I was able to reproduce using v0.3.2. It's fixed now (in the raml1.0 branch).

I took the opportunity to merge a fix for an older issue that is somewhat related: https://github.com/mulesoft/osprey/issues/113

Can you expand on your other issues a bit more, maybe by creating separate github issues, by giving some examples and by describing what you would expect the library to do.

jenschude commented 7 years ago

👍

Opened a new issue about the NODE_TLS_REJECT_UNAUTHORIZED

See #131