fix(security): disallow clear-text HTTP protocol in ApiSession

Author: amrabed

templates/eventbridge/session.py

@@ -41,7 +41,6 @@ def __init__(
             pool_connections=pool_connections,
             pool_maxsize=pool_maxsize,
         )
-        self._session.mount("http://", adapter)
         self._session.mount("https://", adapter)
 
     def get(self, url: str, **kwargs: Any) -> Response:

tests/eventbridge/test_session.py

@@ -12,20 +12,20 @@ def test_api_session_get_uses_timeout(mocker: MockerFixture) -> None:
     session_instance.get.return_value = mock_response
 
     api_session = ApiSession(timeout=15)
-    response = api_session.get("http://example.com/api")
+    response = api_session.get("https://example.com/api")
 
     assert response == mock_response
-    session_instance.get.assert_called_once_with("http://example.com/api", timeout=15)
+    session_instance.get.assert_called_once_with("https://example.com/api", timeout=15)
 
 
 def test_api_session_get_overrides_timeout(mocker: MockerFixture) -> None:
     session_mock = mocker.patch("templates.eventbridge.session.Session")
     session_instance = session_mock.return_value
 
     api_session = ApiSession(timeout=10)
-    api_session.get("http://example.com/api", timeout=5)
+    api_session.get("https://example.com/api", timeout=5)
 
-    session_instance.get.assert_called_once_with("http://example.com/api", timeout=5)
+    session_instance.get.assert_called_once_with("https://example.com/api", timeout=5)
 
 
 if __name__ == "__main__":