Another thing to look at is whether a client handles TLS securely out-of-the-box. If it doesn’t, then you are going to have to do the ssl options dance.
Mint-based clients, including Finch, Mojito, and Tesla with the appropriate adapter, should handle that just fine.
Hackney, and by extension HTTPoison and Tesla with the Hackney adapter, do check the server certificate by default. However, if you want to start tuning the TLS options, e.g. to disable old TLS versions, you are going to have to set all the necessary options yourself:
# This fails, as expected:
iex(1)> HTTPoison.get("https://expired.badssl.com/")
{:error,
%HTTPoison.Error{
id: nil,
reason: {:tls_alert,
{:certificate_expired,
'TLS client: In state certify at ssl_handshake.erl:1764 generated CLIENT ALERT: Fatal - Certificate Expired\n'}}
}}
# But this succeeds while it shouldn't:
iex(2)> HTTPoison.get("https://expired.badssl.com/", [], ssl: [versions: [:"tlsv1.2"]])
{:ok,
%HTTPoison.Response{...}}
Other clients, such as httpc, gun and ibrowse, leave it completely up to you. For instance, Tesla with the default httpc adapter:
iex(3)> Tesla.get("https://expired.badssl.com/")
{:ok,
%Tesla.Env{...}}
I would highly recommend you test your choice of HTTP client against some https://badssl.com endpoints, using the specific configuration (adapter, ssl options) you intend to use, so you can be confident your application gets the TLS protections you expect.
