Skip to content

sslmode should default to "prefer" not "disable" #654

Closed
@samuelcolvin

Description

@samuelcolvin
  • asyncpg version: asyncpg==0.21.0
  • PostgreSQL version: 12.5
  • Do you use a PostgreSQL SaaS? If so, which? Can you reproduce
    the issue with a local PostgreSQL install?
    : Heroku, yes
  • Python version: 3.8.6
  • Platform: macos and ubuntu on heroku
  • Do you use pgbouncer?: no
  • Did you install asyncpg with pip?: yes
  • If you built asyncpg locally, which version of Cython did you use?: NA
  • Can the issue be reproduced under both asyncio and
    uvloop?
    : yes (I guess)

The docstring for connect says:

asyncpg/asyncpg/connection.py

Lines 1757 to 1762 in 92aa806

:param dsn:
Connection arguments specified using as a single string in the
`libpq connection URI format`_:
``postgres://user:password@host:port/database?option=value``.
The following options are recognized by asyncpg: host, port,
user, database (or dbname), password, passfile, sslmode.

(the associated link to the docs is broken, but I've fixed that in #653, should link to here)

But this is not correct, currently asyncpg defaults to the equivalent of sslmode=disable, e.g. it doesn't try to use SSL for the connection, while the linked postgresql.org docs says, regarding sslmode:

prefer (default) first try an SSL connection; if that fails, try a non-SSL connection

e.g. prefer is the default.

asyncpg too should default to prefer.


This caused a connection error when upgrading a heroku database from hobby tier to standard - the latter requires SSL.

From reading the source, it looks like the best work around for now will be to set the environment variable PGSSLMODE=prefer:

if ssl is None:
ssl = os.getenv('PGSSLMODE')

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions