chore: Add warning for insecure connection

Author: dishaprakash

core/client.go

@@ -17,6 +17,7 @@ package core
 import (
 	"context"
 	"fmt"
+	"log"
 	"net/http"
 	"strings"
 
@@ -150,6 +151,10 @@ func (tc *ToolboxClient) newToolboxTool(
 		finalConfig.AuthTokenSources,
 	)
 
+	if (len(remainingAuthnParams) > 0 || len(remainingAuthzTokens) > 0 || len(tc.clientHeaderSources) > 0) && !strings.HasPrefix(tc.baseURL, "https://") {
+		log.Println("WARNING: Sending ID token over HTTP. User data may be exposed. Use HTTPS for secure communication.")
+	}
+
 	// Construct the final tool object.
 	tt := &ToolboxTool{
 		name:                name,

core/client_test.go

@@ -17,9 +17,11 @@
 package core
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -558,6 +560,28 @@ func TestLoadToolAndLoadToolset_ErrorPaths(t *testing.T) {
 	}))
 	defer server.Close()
 
+	// Buffer to capture logs
+	var buf bytes.Buffer
+
+	originalOutput := log.Writer()
+	log.SetOutput(&buf)
+	defer log.SetOutput(originalOutput)
+
+	t.Run("logs warning for HTTP with headers", func(t *testing.T) {
+		buf.Reset()
+
+		client, _ := NewToolboxClient(server.URL,
+			WithHTTPClient(server.Client()),
+		)
+
+		_, _ = client.LoadTool("toolA", context.Background())
+
+		expectedLog := "WARNING: Sending ID token over HTTP"
+		if !strings.Contains(buf.String(), expectedLog) {
+			t.Errorf("expected log message '%s' not found in output: '%s'", expectedLog, buf.String())
+		}
+	})
+
 	t.Run("LoadTool fails when a default option is invalid", func(t *testing.T) {
 		// Setup client with duplicate default options
 		client, _ := NewToolboxClient(server.URL,