search

psf / requests

A simple, yet elegant, HTTP library.
https://requests.readthedocs.io/en/latest/
Apache License 2.0
52.19k stars 9.33k forks source link

Address certificate loading regression #6731

Open nateprewitt opened 5 months ago

nateprewitt commented 5 months ago

Overview

This PR is intended to address two distinct issues introduced with the default cert optimizations originally introduced in 2.32.0. While we continue to refine the settings considered when opting into our optimized context, we'll no longer use the new default if any custom cert values are supplied. This addresses the concurrency issues raised in #6726.

The second piece of this will be ensuring that when opting out of the default SSLContext, we're still supplying to the default CA Cert bundle correctly. This addresses the problems noticed in https://github.com/psf/requests/pull/6710#issuecomment-2137802782 and #6730.

Considerations

We're now duplicating a decent chunk of the logic from cert_verify inside _urllib3_request_context but without our validation exceptions. That's a potential vector for behavioral shifts in the future. We could consolidate some of this behavior in one place but it's going to require constructing a dict and using setattr on our conn in cert_verify while setting pool_kwargs in _urllib3_request_context. I started writing that up but it feels clunky. This is probably going to be a tradeoff of risking drift like we have with Session settings and binding the two behaviors together too tightly.

Testing

I'd like to codify the issues we've encountered through the whole 2.32.x saga in tests to hopefully avoid this in the future. Doing it cleanly without relying on external endpoints is proving to be a bit more involved than I'd like. I think we can harness some of the infrastructure added in #6662, but I haven't had a chance to really dig into that.

Heraldk commented 4 months ago

Is there an ETA for this change or a similar change? 2.32.3 doesn't work for us, as it broke our usage of requests_pkcs12. It looks like that package was updated with a temporary change here, so if a "proper" fix is not intended to be released anytime soon then we can try that. However I'd be keen to take a proper fix for both if that's expected soon!

stratakis commented 2 months ago

The regression is there for some time and the PR is still in draft. Is there some way to move this forward?

raxod502-plaid commented 2 months ago

Maintainers, is there any update here? The latest version of HTTPie is mostly non-functional due to this issue, and we will need to drop it and migrate to other tools if this cannot be addressed.

There does not seem to be any blocking feedback on this PR - can any clarity be provided about what is currently preventing a merge? Is additional contribution required from the community?

kenan-altaki commented 2 months ago

A friendly reminder that this issue has been stagnant for 4 months already.

agm-eratosth commented 1 month ago

Hi @sigmavirus24 you're listed as reviewer for this. Would you like to review this or assign someone else to do so?