Is OpenSSL::SSL::VERIFY_NONE chainable?

[c2ofh]

We have a RestAPI wrapper for all Apis with http.rb included.

The HTTP request is composed depending on what the API needs or requires.

Now there is one API where we need to disable the SSL Verify. Can this be included in the generic HTTP object?

 def http(headers = {})
    http = HTTP.headers(__request_params.merge(headers)).timeout(timeout)
    http = http.follow if __request_follow == :follow
    http = http.cookies(__rest_cookies) if __rest_cookies
    http = http.basic_auth(__rest_basic_auth) if __rest_basic_auth
    http
  end

  def get(url = '', headers = {})
    request do
      http(headers).get("#{@rest_url_base}#{url}", params: __rest_query)
    end
  end

  ...

I would like to add this as option within the http-method or is it needed to append it to the get like this?

  def ssl_context
    return unless  __rest_sll_verify_none

    ctx = OpenSSL::SSL::SSLContext.new
    ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
    ctx
  end

  def get(url = '', headers = {})
    request do
      http(headers).get("#{@rest_url_base}#{url}", params: __rest_query, ssl_context: ssl_context)
    end
  end

[tarcieri]

I'm unclear what you are asking here. Note that we do not recommend setting OpenSSL::SSL::VERIFY_NONE.

[marckohlbrugge]

For anyone else with the same question, here's a workaround to "chain" the SSL context:

options = if use_insecure_mode?
  HTTP::Options.new(ssl: { verify_mode: OpenSSL::SSL::VERIFY_NONE })
else
  HTTP::Options.new
end

http = HTTP::Client.new(options)
http.get("https://untrusted-root.badssl.com").to_s