Updates.

http.go

@@ -2,7 +2,9 @@ package gql
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -10,7 +12,7 @@ import (
 	"golang.org/x/net/http2"
 )
 
-func (b *BaseClient) createHttpClient() (http_client *http.Client) {
+func (b *BaseClient) createHttpClient() (*http.Client, error) {
 	// Optimized connection pool settings for better performance
 	httpTransport := &http.Transport{
 		MaxIdleConns:          100,              // Reduced from 512
@@ -24,7 +26,14 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 		ReadBufferSize:        4096, // Optimize buffer size
 	}
 
-	if strings.HasPrefix(b.endpoint, "http://") {
+	var http_client *http.Client
+
+	// Protect read of endpoint field
+	b.mu.RLock()
+	endpoint := b.endpoint
+	b.mu.RUnlock()
+
+	if strings.HasPrefix(endpoint, "http://") {
 		http_client = &http.Client{
 			Timeout:   30 * time.Second, // Increased for better reliability
 			Transport: httpTransport,
@@ -36,10 +45,12 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 			Message: "Using HTTP/1.1 over http",
 			Pairs:   nil,
 		})
-	} else if strings.HasPrefix(b.endpoint, "https://") {
-		tlsClientConfig := &tls.Config{}
-		if strings.HasPrefix(b.endpoint, "https://") {
-			tlsClientConfig.InsecureSkipVerify = true
+	} else if strings.HasPrefix(endpoint, "https://") {
+		tlsClientConfig := getHTTPClientTLSConfig()
+		if strings.HasPrefix(endpoint, "https://") && tlsClientConfig.InsecureSkipVerify {
+			b.Logger.Warning(&libpack_logger.LogMessage{
+				Message: "TLS certificate verification is disabled. This is insecure and should not be used in production.",
+			})
 		}
 		http2Transport := &http2.Transport{
 			AllowHTTP:          true,
@@ -64,7 +75,25 @@ func (b *BaseClient) createHttpClient() (http_client *http.Client) {
 		b.Logger.Critical(&libpack_logger.LogMessage{
 			Message: "Invalid endpoint - neither http or https",
 		})
-		return nil
+		// Return error instead of nil to prevent nil pointer dereference
+		return nil, fmt.Errorf("invalid endpoint: %s - must start with http:// or https://", endpoint)
+	}
+	return http_client, nil
+}
+
+// getHTTPClientTLSConfig returns TLS configuration for HTTP client
+// By default, TLS verification is enabled for security.
+// Set GRAPHQL_INSECURE_SKIP_VERIFY=true to disable verification (NOT RECOMMENDED for production)
+func getHTTPClientTLSConfig() *tls.Config {
+	skipVerify := os.Getenv("GRAPHQL_INSECURE_SKIP_VERIFY") == "true"
+
+	if skipVerify {
+		// Log warning to stderr when running in insecure mode
+		fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification is disabled. This is insecure and should not be used in production.\n")
+	}
+
+	return &tls.Config{
+		InsecureSkipVerify: skipVerify,
+		MinVersion:         tls.VersionTLS12, // Enforce minimum TLS 1.2 for security
 	}
-	return http_client
 }