Fix: Semgrep grpc-server-insecure-connection

[rahulkhinchi-wq]

Summary

This pull request addresses the Semgrep rule violation grpc-server-insecure-connection, which identifies insecure gRPC server initialization without TLS credentials. Running a gRPC server without encryption exposes communication to interception, tampering, and man-in-the-middle attacks.

Change Details

Modified File

cmd/kat-server/services/grpc-auth-v2.go

Updates

• Added import for:

  "google.golang.org/grpc/credentials"

Replaced insecure gRPC server initialization: grpc.NewServer() with a secure TLS-enabled server:

creds, err := credentials.NewServerTLSFromFile(g.Cert, g.Key)
grpc.NewServer(grpc.Creds(creds))

Added error handling for TLS credential loading to ensure failures are surfaced properly.

Rationale

Semgrep flagged that the server was previously initialized without specifying TLS credentials, resulting in unencrypted network communication. Using grpc.Creds(credentials) ensures that all gRPC traffic is encrypted and authenticated using certificate-based TLS, significantly reducing the risk of message tampering or compromise.

Verification

Confirmed that TLS credentials (cert.pem, cert.key defined by g.Cert and g.Key) are now loaded correctly.
Semgrep rule warning is resolved.
The gRPC server now enforces encrypted connections.
The server continues to register the authorization service as expected.

[cocogitto-bot]

❌ Found 1 compliant commit and 1 non-compliant commits in 36560ef...70cb0d0.

Commit 70cb0d0 by @rahulkhinchi-wq is not conform to the conventional commit specification :

• message: `Merge pull request first time image down load takes a long time, the README instructions should accommodate this #1 from rahulkhinchi-wq/fix/semgrep-grpc-server-insecure-connection-45-HJpme2LvKr

fix: semgrep-grpc-server-insecure-connection`

• cause:

  Missing commit type separator `:`
  
  Caused by:
       --> 1:6
        |
      1 | Merge pull request #1 from rahulkhinchi-wq/fix/semgrep-grpc-server-insecure-connection-45-HJpme2LvKr
        |      ^---
        |
        = expected scope or type_separator