Skip to content

Commit b68f73e

Browse files
committed
fix!: Warn about https only during tool initialization
1 parent 98548e8 commit b68f73e

File tree

1 file changed

+4
-13
lines changed
  • packages/toolbox-core/src/toolbox_core

1 file changed

+4
-13
lines changed

packages/toolbox-core/src/toolbox_core/tool.py

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -257,27 +257,18 @@ async def __call__(self, *args: Any, **kwargs: Any) -> str:
257257
payload[param] = await resolve_value(value)
258258

259259
# create headers for auth services
260-
auth_headers = {}
260+
headers = {}
261261
for auth_service, token_getter in self.__auth_service_token_getters.items():
262-
auth_headers[self.__get_auth_header(auth_service)] = await resolve_value(
262+
headers[self.__get_auth_header(auth_service)] = await resolve_value(
263263
token_getter
264264
)
265265
for client_header_name, client_header_val in self.__client_headers.items():
266-
auth_headers[client_header_name] = await resolve_value(client_header_val)
267-
268-
# ID tokens contain sensitive user information (claims). Transmitting
269-
# these over HTTP exposes the data to interception and unauthorized
270-
# access. Always use HTTPS to ensure secure communication and protect
271-
# user privacy.
272-
if auth_headers and not self.__url.startswith("https://"):
273-
warn(
274-
"Sending ID token over HTTP. User data may be exposed. Use HTTPS for secure communication."
275-
)
266+
headers[client_header_name] = await resolve_value(client_header_val)
276267

277268
async with self.__session.post(
278269
self.__url,
279270
json=payload,
280-
headers=auth_headers,
271+
headers=headers,
281272
) as resp:
282273
body = await resp.json()
283274
if resp.status < 200 or resp.status >= 300:

0 commit comments

Comments
 (0)