Do not use unverified hostname or certificates in connection Do not

I assume this is based on the bogus <a href="https://www.cvedetails.com/cve/CVE-2023-4

Cryptographic API Misuse Vulnerability : Missing SSL Certificate Validation about httpie HOT 1 CLOSED

gxx777 commented on June 12, 2024

Cryptographic API Misuse Vulnerability : Missing SSL Certificate Validation

from httpie.

jkbrzt commented on June 12, 2024

I assume this is based on the bogus CVE-2023-48052.

Do not use urllib3.disable_warnings() to close tls warning , it is so dangerous! Please delete it.

Even though the printing of warnings to the terminal is disabled, SSL verification still does occur — unless the user disables it via --verify=no. We don’t want SSL warnings in the output. Please see https://urllib3.readthedocs.io/en/stable/advanced-usage.html#tls-warnings

Set get request verify=True ,it will do ssl certificate validation.

verify=False is only used for internal version check requests to a hard-coded URL, not the actual user requests.

(Yes, it was left there unintentionally, and we’ll remove it in the upcoming release, but it poses no danger.)

from httpie.