search

nextgenhealthcare / connect

The swiss army knife of healthcare integration.
Other
869 stars 265 forks source link

[BUG] SSL used without being configured #5996

Closed elavy-harris closed 7 months ago

elavy-harris commented 7 months ago

Describe the bug SSL used for communications in an HTTP Sender destination without being configured

To Reproduce Setup steps (if required). Example:

  1. Configure an HTTP receiver (not necessarily Mirth) that requires SSL communications.
  2. Create a channel with an HTTP Sender destination. Do not configure SSL, but specify an "https://..." URL.
  3. Capture communications using Wireshark or tcpdump or equivalent.

Steps to reproduce the behavior:

  1. Send a message.
  2. Observe that the message is transmitted.
  3. Examine the Wireshark capture and observe that the communications are encrypted.

Expected behavior That Mirth would fail to establish communications with the server, because the server is requiring SSL and Mirth is configured not to use it.

Actual behavior Messages flow, with SSL being used.

Environment (please complete the following information):

Additional context In my original case, the URL was specified as a variable, i.e. ${target_url}, so the UI could not alert me to the mismatch between the HTTPS URL and non-SSL destination.

pacmano1 commented 7 months ago

That seems like normal behavior. If you are referring to the TLS plugin and it is set to off, that is normal behavior.

tonygermano commented 7 months ago

I don't think this is a bug either. Using a protocol of https in the URL tells it to use TLS. Just because you don't have the SSL plugin configured for that channel doesn't prevent it from using https if that's what you put in the URL. That's the same way it would work if you didn't have the commercial plugin installed.

elavy-harris commented 7 months ago

Thank you both for your comments. Closing the issue.