In server/game_server.py, secure_socket() only enables TLS when both tls_cert and tls_key are configured. If either value is missing, the function returns the original socket without reporting that TLS was not enabled.
This is problematic when only one of the two TLS settings is configured. A partial or incorrect configuration is silently treated as a request to run without TLS. The server can therefore start and accept connections in plaintext, while the user or administrator may reasonably believe that TLS is configured.
This is especially undesirable because there is no indication in this code path that the TLS configuration was incomplete. A missing key or certificate can therefore result in the server unintentionally accepting plaintext connections instead of failing during startup and making the configuration problem immediately visible.
Suggested changes
Explicitly validate the TLS configuration before creating the listening socket. If exactly one of tls_cert or tls_key is configured, raise a clear configuration error identifying the missing setting. Only disable TLS when both values are intentionally unset, and only wrap the socket when both are present.
In
server/game_server.py,secure_socket()only enables TLS when bothtls_certandtls_keyare configured. If either value is missing, the function returns the original socket without reporting that TLS was not enabled.This is problematic when only one of the two TLS settings is configured. A partial or incorrect configuration is silently treated as a request to run without TLS. The server can therefore start and accept connections in plaintext, while the user or administrator may reasonably believe that TLS is configured.
This is especially undesirable because there is no indication in this code path that the TLS configuration was incomplete. A missing key or certificate can therefore result in the server unintentionally accepting plaintext connections instead of failing during startup and making the configuration problem immediately visible.
Suggested changes
Explicitly validate the TLS configuration before creating the listening socket. If exactly one of
tls_certortls_keyis configured, raise a clear configuration error identifying the missing setting. Only disable TLS when both values are intentionally unset, and only wrap the socket when both are present.