Added a secure-by-default HTTP client for databases.

This client is used for NMDC but not JDP, since the latter doesn't (yet) support
HTTP Strict Transport Security (HSTS). Probably a good idea to encourage them to
support this feature in the near future.

databases/errors.go

@@ -124,3 +124,14 @@ type ResourceEndpointNotFoundError struct {
 func (e ResourceEndpointNotFoundError) Error() string {
 	return fmt.Sprintf("Can't determine endpoint for resource '%s' in database '%s'", e.ResourceId, e.Database)
 }
+
+// this error type is emitted if an endpoint redirects an HTTPS request to an
+// HTTP endpoint (it's NUTS that this can happen!)
+type DowngradedRedirectError struct {
+	Endpoint string
+}
+
+func (e DowngradedRedirectError) Error() string {
+	return fmt.Sprintf("The endpoint %s is attempting to downgrade an HTTPS request to HTTP",
+		e.Endpoint)
+}

databases/http.go

@@ -0,0 +1,48 @@
+// Copyright (c) 2023 The KBase Project and its Contributors
+// Copyright (c) 2023 Cohere Consulting, LLC
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of
+// this software and associated documentation files (the "Software"), to deal in
+// the Software without restriction, including without limitation the rights to
+// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+// of the Software, and to permit persons to whom the Software is furnished to do
+// so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package databases
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/StalkR/hsts"
+)
+
+// Here's a secure HTTP client that can be used to connect to databases. It
+// sets a reasonable timeout and enables HTTP Strict Transport Security (HSTS).
+func SecureHttpClient() http.Client {
+	client := http.Client{
+		Timeout: time.Second * 10,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if req.URL.Scheme == "http" {
+				return DowngradedRedirectError{
+					Endpoint: fmt.Sprintf("%s%s", req.URL.Host, req.URL.Path),
+				}
+			}
+			return http.ErrUseLastResponse
+		},
+	}
+	client.Transport = hsts.New(client.Transport) // enable HSTS
+	return client
+}

databases/jdp/database.go

@@ -92,7 +92,11 @@ func NewDatabase(orcid string) (databases.Database, error) {
 		}
 	}
 
+	// NOTE: we can't enable HSTS for JDP requests at this time, because the
+	// NOTE: server doesn't seem to support it. Maybe raise this issue with the
+	// NOTE: team?
 	return &Database{
+		//Client:          databases.SecureHttpClient(),
 		Id:              "jdp",
 		Orcid:           orcid,
 		Secret:          secret,

databases/nmdc/database.go

@@ -59,17 +59,6 @@ type Database struct {
 	EndpointForHost map[string]string
 }
 
-// This error type is emitted if an NMDC endpoint redirects an HTTPS request
-// to an HTTP endpoint.
-type DowngradedRedirectError struct {
-	Endpoint string
-}
-
-func (e DowngradedRedirectError) Error() string {
-	return fmt.Sprintf("An NMDC database endpoint (%s) is attempting to downgrade an HTTPS request to HTTP",
-		e.Endpoint)
-}
-
 func NewDatabase(orcid string) (databases.Database, error) {
 	if orcid == "" {
 		return nil, databases.UnauthorizedError{
@@ -117,17 +106,7 @@ func NewDatabase(orcid string) (databases.Database, error) {
 
 	// NOTE: we prevent redirects from HTTPS -> HTTP!
 	db := &Database{
-		Client: http.Client{
-			Timeout: time.Second * 10,
-			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-				if req.URL.Scheme == "http" {
-					return DowngradedRedirectError{
-						Endpoint: fmt.Sprintf("%s%s", req.URL.Host, req.URL.Path),
-					}
-				}
-				return http.ErrUseLastResponse
-			},
-		},
+		Client: databases.SecureHttpClient(),
 		EndpointForHost: map[string]string{
 			"https://data.microbiomedata.org/data/": nerscEndpoint,
 			"https://nmdcdemo.emsl.pnnl.gov/":       emslEndpoint,

go.mod

@@ -5,6 +5,7 @@ go 1.22
 toolchain go1.23.1
 
 require (
+	github.com/StalkR/hsts v1.0.3
 	github.com/danielgtaylor/huma/v2 v2.27.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1

go.sum

@@ -1,3 +1,5 @@
+github.com/StalkR/hsts v1.0.3 h1:3dAfhmsMFtLZaFGjsU/XNAvSD44yXeOnL31SLXyFRa8=
+github.com/StalkR/hsts v1.0.3/go.mod h1:kde3l3eCEeFRVvA8FX524o9Z4H8tTtAo2VjdvMjji7Y=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/danielgtaylor/huma/v2 v2.27.0 h1:yxgJ8GqYqKeXw/EnQ4ZNc2NBpmn49AlhxL2+ksSXjUI=
 github.com/danielgtaylor/huma/v2 v2.27.0/go.mod h1:NbSFXRoOMh3BVmiLJQ9EbUpnPas7D9BeOxF/pZBAGa0=