From aebe8985c57f7b24b7245066d85e1bf3b5b58313 Mon Sep 17 00:00:00 2001
From: Carl Bergquist <carl@grafana.com>
Date: Wed, 25 Nov 2020 14:56:34 +0100
Subject: [PATCH] prefer server cipher suites (#29379)

G402 (CWE-295):  TLS PreferServerCipherSuites set false.

Signed-off-by: bergquist <carl.bergquist@gmail.com>
---
 pkg/api/http_server.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/api/http_server.go b/pkg/api/http_server.go
index c08557fe263..42c80d94a70 100644
--- a/pkg/api/http_server.go
+++ b/pkg/api/http_server.go
@@ -249,7 +249,7 @@ func (hs *HTTPServer) configureHttp2() error {
 
 	tlsCfg := &tls.Config{
 		MinVersion:               tls.VersionTLS12,
-		PreferServerCipherSuites: false,
+		PreferServerCipherSuites: true,
 		CipherSuites: []uint16{
 			tls.TLS_CHACHA20_POLY1305_SHA256,
 			tls.TLS_AES_128_GCM_SHA256,