Security question: Does the heroku_cloud_backup gem use HTTPS?

[KelseyDH]

During a recent a security review, we were asked about how we ensure the security of our data while in transfer when using this gem to back up our database to Google & AWS.

While I realize running heroku pgbackups:url -a appname & ENV["PGBACKUPS_URL"] gives back an https url, I’m still unsure if the other end the process sucks it down from that url, or if this cloud backup gem via Fog instead posts something to a different url (and in which case is it https?).

It looks secure from what I can gather from looking at this gem's source code, but I think it's still prudent to ask for a clarification here.

[KelseyDH]

So far here is a breakdown of what I think happens when HerokuCloudBackup.execute runs:

1. heroku_cloud_backup retrieves the latest pg_backup file via HTTPS:

Looks good since Heroku's config var ENV["PGBACKUPS_URL"] _uses https_ with these URLs, looking like: https://57406:xxxxxxxxxxxxxxxx@pgbackups.herokuapp.com/client

2. heroku_cloud_backup uses the Fog gem to connect / upload to the cloud:

_This is where I am uncertain whether this gem defaults to http or https._ From what I can tell this gem interacts with cloud providers by relying on Fog to initialize a connection object via the Fog::Storage module api. Passing in parameters like this for Amazon / Google when initializing the fog connection:

  when 'aws'
        Fog::Storage.new(
          provider: 'AWS',
          aws_access_key_id: key1,
          aws_secret_access_key: key2,
          region: region,
        )

      when 'google'
        Fog::Storage.new(
          provider: 'Google',
          google_storage_secret_access_key: key1,
          google_storage_access_key_id: key2,
        )

This gem then uses this Fog connection object as its API to upload files cloud providers. In this gem, the actual upload appears to come from this line of code::

connection.directory.files.create(key: "#{backup_path}/#{b["from_name"]}/#{name}", body: open(public_url))

Fog::Storage module seems to use the Excon gem to make the web request / web socket, which has an option to default requests to HTTPS unless :ssl_verify_peer = false is passed in. I'm not sure whether Fog overrides this, or whether this is what governs connections to automaticaly be HTTPS.

Based on how this gem uses the Fog api, can anybody here shed light on whether heroku_cloud_backup defaults to using HTTP or HTTPS?