Repository: elastic/apm-agent-python

Issue:
`check` cmd output differs from documentation. 
Running `python manage.py elasticapm check` returns an error if no `Secret_Token` is configured. Documentation states that configuration is optional. 



Discussion:
Good catch. I wonder if we should change this to instead issue a warning if a secret token is set, but the server URL isn't https.
I think a warning would be a good idea, in any case as soon as the server only uses http to indicate there is an insecure connection. 

Resolving patch:
diff --git a/elasticapm/contrib/django/management/commands/elasticapm.py b/elasticapm/contrib/django/management/commands/elasticapm.py
--- a/elasticapm/contrib/django/management/commands/elasticapm.py
+++ b/elasticapm/contrib/django/management/commands/elasticapm.py
@@ -143,12 +143,14 @@ def handle_check(self, command, **options):
         """Check your settings for common misconfigurations"""
         passed = True
         client = DjangoClient()
-        # check if org/app and token are set:
-        is_set = lambda x: x and x != 'None'
-        values = [client.config.service_name, client.config.secret_token]
-        if all(map(is_set, values)):
+
+        def is_set(x):
+            return x and x != 'None'
+
+        # check if org/app is set:
+        if is_set(client.config.service_name):
             self.write(
-                'Service name and secret token are set, good job!',
+                'Service name is set, good job!',
                 green
             )
         else:
@@ -156,11 +158,12 @@ def handle_check(self, command, **options):
             self.write(
                 'Configuration errors detected!', red, ending='\n\n'
             )
-            if not is_set(client.config.service_name):
-                self.write("  * SERVICE_NAME not set! ", red, ending='\n')
-            if not is_set(client.config.secret_token):
-                self.write("  * SECRET_TOKEN not set!", red, ending='\n')
+            self.write("  * SERVICE_NAME not set! ", red, ending='\n')
             self.write(CONFIG_EXAMPLE)
+
+        # secret token is optional but recommended
+        if not is_set(client.config.secret_token):
+            self.write("  * optional SECRET_TOKEN not set", yellow, ending='\n')
         self.write('')
 
         server_url = client.config.server_url
@@ -183,6 +186,9 @@ def handle_check(self, command, **options):
                                    'but the colon is left out', red, ending='\n')
                 else:
                     self.write('SERVER_URL {0} looks fine'.format(server_url, ), green)
+                # secret token in the clear not recommended
+                if is_set(client.config.secret_token) and parsed_url.scheme.lower() == 'http':
+                    self.write("  * SECRET_TOKEN set but server not using https", yellow, ending='\n')
             else:
                 self.write('  * SERVER_URL has scheme {0} and we require '
                            'http or https!'.format(parsed_url.scheme, ), red, ending='\n')


Test patch:
diff --git a/tests/contrib/django/django_tests.py b/tests/contrib/django/django_tests.py
--- a/tests/contrib/django/django_tests.py
+++ b/tests/contrib/django/django_tests.py
@@ -1147,7 +1147,23 @@ def test_settings_missing():
     output = stdout.getvalue()
     assert 'Configuration errors detected' in output
     assert 'SERVICE_NAME not set' in output
-    assert 'SECRET_TOKEN not set' in output
+    assert 'optional SECRET_TOKEN not set' in output
+
+
+def test_settings_missing_secret_token_no_https():
+    stdout = compat.StringIO()
+    with override_settings(ELASTIC_APM={'SERVER_URL': 'http://foo'}):
+        call_command('elasticapm', 'check', stdout=stdout)
+    output = stdout.getvalue()
+    assert 'optional SECRET_TOKEN not set' in output
+
+
+def test_settings_secret_token_https():
+    stdout = compat.StringIO()
+    with override_settings(ELASTIC_APM={'SECRET_TOKEN': 'foo', 'SERVER_URL': 'https://foo'}):
+        call_command('elasticapm', 'check', stdout=stdout)
+    output = stdout.getvalue()
+    assert 'SECRET_TOKEN not set' not in output
 
 
 def test_middleware_not_set():