HTTP

Host Kloset stores on an HTTP or HTTPS endpoint.

Latest v1.1.4 · Oct 19, 2026
Documented 2 releases
All changelogs
v1.1.4 v1.1.3

v1.1.4

stable

Refuses credentials over unverified TLS or in the URL without `insecure`, and rejects redirects to another host.

Release

Security

  • Credentials are now refused when tls_no_verify=true is set, unless insecure=true is also set. Credentials embedded in the URL, such as http://user:pass@host, are covered by the same check. (#216)
  • Redirects to a different host are rejected. Before, only a redirect from HTTPS to HTTP was refused. (#221)

v1.1.3

stable

Hardens HTTP connections, refuses tokens over plain HTTP by default, and adds a request timeout.

Release

Security

  • auth_token is refused over plain HTTP unless insecure=true is also set.
  • Redirects from HTTPS to HTTP are rejected, so a connection can no longer be downgraded to plain HTTP.
  • Error responses from the server are bounded in size and sanitized before they are reported.

New

  • The timeout option limits how long each request may take. It accepts a duration such as 30s or 10m, and defaults to 5 minutes.

Fixes

  • Cancelling an operation now stops its pending HTTP requests.

Product

Integrations

Resources

Company

Newsletter