[Bug] TLS is not verified during OAuth callback

[mattbostock]

• What Grafana version are you using?

4.5.1

• What OS are you running grafana on?

Linux

See:

grafana/pkg/api/login_oauth.go

Lines 98 to 109 in c114c46

	tr := &http.Transport{
	TLSClientConfig: &tls.Config{
	InsecureSkipVerify: true,
	Certificates: []tls.Certificate{cert},
	RootCAs: caCertPool,
	},
	}
	sslcli := &http.Client{Transport: tr}
	oauthCtx = context.Background()
	oauthCtx = context.WithValue(oauthCtx, oauth2.HTTPClient, sslcli)
	}

TLS should be verified by default.

Related: #8812

[bergquist]

💯

But this would have to be configurable for those who don't want it. Not sure if it should be one global setting for all outgoing requests or one per oauth, datasources, alert notifications. etc

[mattbostock]

I made a start here: #9378

I haven't added a UI option, but wanted to get something out so that at least others can patch their deployment if they wish to.

#9377 tackles this more comprehensively for datasources and adds an explicit 'skip verify' option.

[mattbostock]

Seems that TLS verification is only skipped if TLS client authentication is enabled: #9419, which mitigates the issue for some installations.