Unable to establish web socket connection for market feed

[aman2000verma]

• 5paisa Python SDK version: 0.7.6 and 0.7.3
• Python version: 3.11.6 and 3.12.1
• Operating System: Windows 11

Description

Trying to subscribe to market feed but the program terminates as opposed to start displaying the ticks.

What I Did

Did nothing new, just ran the script I created back in October 2023 when it was working fine (with Python 3.11.6 and SDK 0.7.3).
Now, the script is not able to create a web socket connection. I tried using Python 3.12.1 and SDK 0.7.6 but same issue.
On digging deep, I found this error

[SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled (_ssl.c:1006)

by making these changes in connect function in py5paisa.py

def on_error(ws, err):
        log_response(err)
self.ws.on_error = on_error

I also tried downgrading the versions of websocket-client and certifi but it didn't work

Does anyone else have have such issue?

[nvn-nil]

I think this is a py3.12 issue. Can you confirm python 3.11 (or even 10) throws the same error?

I have run into this SSL error when making requests to some websites (dev-openapi.5paisa.com is one of them) from python 3.12. I worked around this by using a custom session and HTTPAdapter with some checks disabled or downgraded. I don't recommend it if you don't know what you're doing.

Not working for these guys but hope it helps you. :)

[aman2000verma]

Thanks for the reply. I had to fallback to June release of Python 3.11 to make it work. There is actually a security issue as mentioned in CVE-2023-40217 which is fixed in all versions of Python released after 24 August including 3.8, 3.9, 3.10, 3.11, 3.12.
Now using Python 3.11.4 Release Date: June 6, 2023 and its working fine

@5paisa
Though the dev team should look into it as it mentioned as a vulnerability. Here is the original comment from Python release docs
"gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith."