Repository navigation
requests: Add ssl argument to pass a verifying SSLContext. - #1175
Open
joshdoesthis wants to merge 2 commits into
Open
joshdoesthis wants to merge 2 commits into
joshdoesthis wants to merge 2 commits into
Conversation
requests builds its own tls.SSLContext with verify_mode CERT_NONE and offers no way to change it, so HTTPS requests accept any certificate. Add an optional ssl argument to request() and the method helpers that takes an SSLContext, as umqtt.simple does. When given, the socket is wrapped with it and the host passed as server_hostname, and redirects keep using it. When None, behaviour is unchanged. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Joshua Wilson <joshua@Joshuas-Mac-mini.local>
tls.SSLContext.load_verify_locations is a C method that takes no keyword arguments, so cadata=root_der raises TypeError on a board. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Joshua Wilson <joshua@Joshuas-Mac-mini.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
requestsbuilds its owntls.SSLContextand setsverify_mode = tls.CERT_NONE, with no way to change it. So HTTPS requests accept any server certificate, as reported in #838.This adds an optional
sslargument torequest()and the method helpers. It takes anSSLContext, asumqtt.simpledoes. When it's given,requestswraps the socket with that context and passes the host asserver_hostname, so a context withCERT_REQUIREDand loaded CA certificates verifies the chain and the hostname. When it'sNone, nothing changes.Tested on the unix port and on an RPI_PICO2_W running 1.29.0, against a server with a valid chain and one with a self-signed certificate (rejected). A test is added under
python-ecosys/requests/test_requests.py. Version bumped to 1.2.0.Fixes #838.