Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sslmode should default to "prefer" not "disable" #654

Closed
samuelcolvin opened this issue Nov 14, 2020 · 0 comments · Fixed by #660
Closed

sslmode should default to "prefer" not "disable" #654

samuelcolvin opened this issue Nov 14, 2020 · 0 comments · Fixed by #660

Comments

@samuelcolvin
Copy link
Contributor

samuelcolvin commented Nov 14, 2020

  • asyncpg version: asyncpg==0.21.0
  • PostgreSQL version: 12.5
  • Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
    the issue with a local PostgreSQL install?
    : Heroku, yes
  • Python version: 3.8.6
  • Platform: macos and ubuntu on heroku
  • Do you use pgbouncer?: no
  • Did you install asyncpg with pip?: yes
  • If you built asyncpg locally, which version of Cython did you use?: NA
  • Can the issue be reproduced under both asyncio and
    uvloop?
    : yes (I guess)

The docstring for connect says:

asyncpg/asyncpg/connection.py

Lines 1757 to 1762 in 92aa806

:param dsn:
Connection arguments specified using as a single string in the
`libpq connection URI format`_:
``postgres://user:password@host:port/database?option=value``.
The following options are recognized by asyncpg: host, port,
user, database (or dbname), password, passfile, sslmode.

(the associated link to the docs is broken, but I've fixed that in #653, should link to here)

But this is not correct, currently asyncpg defaults to the equivalent of sslmode=disable, e.g. it doesn't try to use SSL for the connection, while the linked postgresql.org docs says, regarding sslmode:

prefer (default) first try an SSL connection; if that fails, try a non-SSL connection

e.g. prefer is the default.

asyncpg too should default to prefer.


This caused a connection error when upgrading a heroku database from hobby tier to standard - the latter requires SSL.

From reading the source, it looks like the best work around for now will be to set the environment variable PGSSLMODE=prefer:

if ssl is None:
ssl = os.getenv('PGSSLMODE')

elprans added a commit that referenced this issue Nov 26, 2020
Switch the default SSL mode from 'disabled' to 'prefer'.  This matches
libpq's behavior and is a sensible thing to do.

Fixes: #654
elprans added a commit that referenced this issue Nov 26, 2020
Switch the default SSL mode from 'disabled' to 'prefer'.  This matches
libpq's behavior and is a sensible thing to do.

Fixes: #654
elprans added a commit that referenced this issue Nov 27, 2020
Switch the default SSL mode from 'disabled' to 'prefer'.  This matches
libpq's behavior and is a sensible thing to do.

Fixes: #654
elprans added a commit that referenced this issue Nov 29, 2020
Switch the default SSL mode from 'disabled' to 'prefer'.  This matches
libpq's behavior and is a sensible thing to do.

Fixes: #654
elprans added a commit that referenced this issue Nov 29, 2020
Switch the default SSL mode from 'disabled' to 'prefer'.  This matches
libpq's behavior and is a sensible thing to do.

Fixes: #654
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant