DiodeClient forces HTTPS for token endpoint when target uses grpc:// (plain HTTP)

[1mJu57L34rn1ng]

Version Info:

• SDK: netboxlabs-diode-sdk 1.12.0
• Diode Server (ingester): v2.1.0-c017ee1
• Python: 3.11.2

---

Description:

I am trying to connect to a Diode server that is exposed via plain HTTP (not HTTPS). The server is behind an nginx reverse proxy listening on port 8080 (mapped to container's port 80).

I specified the target as grpc://<IP>:8080 . However, during the client.ingest() call, the SDK ignores the URI scheme and attempts to obtain the access token over HTTPS against the same port.

As a result, the request fails with an SSL error because the nginx server expects plain HTTP, not HTTPS.

---

Error:

Failed to obtain access token: HTTPSConnectionPool(host='<IP>', port=8080): Max retries exceeded with url: /auth/token (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:992)')))

---

What I tried:

1. Parameter approach: Passing skip_tls_verify=True to DiodeClient.

   • Result: TypeError: DiodeClient.__init__() got an unexpected keyword argument 'skip_tls_verify'

2. Environment variable: Setting DIODE_SKIP_TLS_VERIFY=true in the environment.

   • Result: No effect. The client still attempts HTTPS.

---

Reproducer:

import os
from netboxlabs.diode.sdk import DiodeClient
from netboxlabs.diode.sdk.ingester import Entity, Tag
from dotenv import load_dotenv

load_dotenv()

client = DiodeClient(
    target="grpc://<IP>:8080",  # Plain HTTP expected
    app_name="TEST",
    app_version="0.1",
    client_id=os.getenv("DIODE_CLIENT_ID"),
    client_secret=os.getenv("DIODE_CLIENT_SECRET"),
)

with client:
    tag = Tag(
        name="test:tag",
        slug="test_tag",
        description="Test tag",
        color="1860f2",
        weight=100,
    )
    response = client.ingest(entities=[Entity(tag=tag)])

Expected behavior:

When target uses the grpc:// scheme (instead of grpcs://), the token acquisition endpoint should default to HTTP (or at least respect the DIODE_SKIP_TLS_VERIFY environment variable). The client should not force HTTPS for the auth endpoint if the main connection is not secure.

[leoparente]

hi @1mJu57L34rn1ng I looked into this on 1.12.0. The grpc:// scheme on its own is actually handled correctly: with just target="grpc://<IP>:8080" and nothing else set, the SDK requests the token over http://<IP>:8080/auth/token, which is what you want.

The HTTPS attempt is coming from DIODE_SKIP_TLS_VERIFY. When that variable is truthy, the auth code forces the token endpoint to HTTPS even when the target is plain grpc://. Since you load a .env and mentioned setting DIODE_SKIP_TLS_VERIFY=true, that's almost certainly what produced the WRONG_VERSION_NUMBER error. It did have an effect, just the wrong one.

Quickest unblock: keep target="grpc://<IP>:8080" and remove DIODE_SKIP_TLS_VERIFY from your environment and .env. The token request then goes over HTTP and the SSL error disappears. But we will do a proper fix regarding DIODE_SKIP_TLS_VERIFY and will be present in next release

[1mJu57L34rn1ng]

@leoparente Thank you for the explanation! I should have been more consistent in reading the documentation)