From fe4c0022d7b5582951aeee9b9a46d6fb35f668ad Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Mon, 1 Jun 2015 13:24:08 -0700 Subject: [PATCH] Add a warning an HTTPS connection is not used Update RemoteClientConfiguration to warn the user that they really should be using HTTPS. See gh-3087 --- .../remote/client/RemoteClientConfiguration.java | 4 ++++ .../remote/client/RemoteClientConfigurationTests.java | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/spring-boot-developer-tools/src/main/java/org/springframework/boot/developertools/remote/client/RemoteClientConfiguration.java b/spring-boot-developer-tools/src/main/java/org/springframework/boot/developertools/remote/client/RemoteClientConfiguration.java index 81a38cf744..27da0482b6 100644 --- a/spring-boot-developer-tools/src/main/java/org/springframework/boot/developertools/remote/client/RemoteClientConfiguration.java +++ b/spring-boot-developer-tools/src/main/java/org/springframework/boot/developertools/remote/client/RemoteClientConfiguration.java @@ -89,6 +89,10 @@ public class RemoteClientConfiguration { && !remoteProperties.getRestart().isEnabled()) { logger.warn("Remote restart and debug are both disabled."); } + if (!this.remoteUrl.startsWith("https://")) { + logger.warn("The connection to " + this.remoteUrl + + " is insecure. You should use a URL starting with 'https://'."); + } } /** diff --git a/spring-boot-developer-tools/src/test/java/org/springframework/boot/developertools/remote/client/RemoteClientConfigurationTests.java b/spring-boot-developer-tools/src/test/java/org/springframework/boot/developertools/remote/client/RemoteClientConfigurationTests.java index 284f90f698..5aad2cc81a 100644 --- a/spring-boot-developer-tools/src/test/java/org/springframework/boot/developertools/remote/client/RemoteClientConfigurationTests.java +++ b/spring-boot-developer-tools/src/test/java/org/springframework/boot/developertools/remote/client/RemoteClientConfigurationTests.java @@ -90,6 +90,12 @@ public class RemoteClientConfigurationTests { containsString("Remote restart and debug are both disabled")); } + @Test + public void warnIfNotHttps() throws Exception { + configureWithRemoteUrl("http://localhost"); + assertThat(this.output.toString(), containsString("is insecure")); + } + @Test public void doesntWarnIfUsingHttps() throws Exception { configureWithRemoteUrl("https://localhost");