Skip to content

Verification of TLS certificates should not be disabled #37

@smarsching

Description

@smarsching

At the moment, pyCFClient disables the verification of the remote TLS certificate by explicitly passing verify=False to all request methods. This makes the software vulnerable to MITM attacks, which can pose a significant problem when also sending credentials.

I belive that instead of forcibly setting verify=False, this should be a configuration option that is passed to ChannelFinderClient, just like the BaseURL, username, and password. It would be optimal if the safe default value of True was used, but if there are worries about breaking backwards compatibility with existing code which expects the verification to be disabled, we could keep the default value of False for now.

While making this change, we can also simplify the code by setting session.verify instead of explicitly passing verify each time one of the methods of session is called.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions