Skip to content

sslmode should default to "prefer" not "disable" #654

Closed

Description

@samuelcolvin
  • asyncpg version: asyncpg==0.21.0
  • PostgreSQL version: 12.5
  • Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
    the issue with a local PostgreSQL install?
    : Heroku, yes
  • Python version: 3.8.6
  • Platform: macos and ubuntu on heroku
  • Do you use pgbouncer?: no
  • Did you install asyncpg with pip?: yes
  • If you built asyncpg locally, which version of Cython did you use?: NA
  • Can the issue be reproduced under both asyncio and
    uvloop?
    : yes (I guess)

The docstring for connect says:

asyncpg/asyncpg/connection.py

Lines 1757 to 1762 in 92aa806

:param dsn:
Connection arguments specified using as a single string in the
`libpq connection URI format`_:
``postgres://user:password@host:port/database?option=value``.
The following options are recognized by asyncpg: host, port,
user, database (or dbname), password, passfile, sslmode.

(the associated link to the docs is broken, but I've fixed that in #653, should link to here)

But this is not correct, currently asyncpg defaults to the equivalent of sslmode=disable, e.g. it doesn't try to use SSL for the connection, while the linked postgresql.org docs says, regarding sslmode:

prefer (default) first try an SSL connection; if that fails, try a non-SSL connection

e.g. prefer is the default.

asyncpg too should default to prefer.


This caused a connection error when upgrading a heroku database from hobby tier to standard - the latter requires SSL.

From reading the source, it looks like the best work around for now will be to set the environment variable PGSSLMODE=prefer:

if ssl is None:
ssl = os.getenv('PGSSLMODE')

Activity

  1. added 4 commits that reference this issue on Nov 26, 2020
    743c18e
    8b39a33
    c8e897d
    357fbab
  2. added a commit that references this issue on Nov 29, 2020
    16183aa
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions