Harmonizing Default HTTP Client Across Codebase

[heikkilamarko]

The ZITADEL OIDC codebase defines a custom http.Client as the default (DefaultHTTPClient):

oidc/pkg/http/http.go

Line 17 in 668fb0d

var DefaultHTTPClient = &http.Client{

However, in jwt_profile.go, the standard http.DefaultClient is used instead:

oidc/pkg/client/profile/jwt_profile.go

Line 73 in 668fb0d

httpClient: http.DefaultClient,

For certain development and testing purposes, we are replacing ZITADEL's default HTTP client as follows:

import (
  zhttp "github.com/zitadel/oidc/v3/pkg/http"
)
...

zhttp.DefaultHTTPClient = &http.Client{
	Timeout: 30 * time.Second,
	Transport: &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
		},
	},
}

This approach does not apply to jwt_profile.go, as it uses a different default HTTP client.

Using a consistent default HTTP client across the codebase would make global overrides more straightforward. What are your thoughts on this?

[elinashoko]

Thank you for getting in touch @heikkilamarko!
@muhlemmer @livio-a what are your thoughts on this?