fix: check peers certificate when using https transport #41
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, the peers certificate identity was not checked. By that, man-in-the-middle attacks where possible by using self signed certificates. The fix removes the CURLOPT_SSL_VERIFYPEER=0 configuration, so that the CURL default is used and the certificate is properly checked.
|
The fact that the option needs to be changed on several places indicates the need of some additional refactoring. Also it's a bit misleading, that a method Thanks for reporting and fixing this issue. I'll create another release containing the fix. |
Yes, I thought exactly the same. I just stumbled upon that by searching for possible performance improvements (like reduction of allocations ...) |
|
PRs are always welcome! 👍 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously, the peers certificate identity was not checked.
By that, man-in-the-middle attacks where possible by using
self signed certificates.
The fix removes the
CURLOPT_SSL_VERIFYPEER=0configuration,so that the CURL default is used and the certificate is properly
checked.
closes #42