-
Notifications
You must be signed in to change notification settings - Fork 18
Description
At the moment, pyCFClient disables the verification of the remote TLS certificate by explicitly passing verify=False to all request methods. This makes the software vulnerable to MITM attacks, which can pose a significant problem when also sending credentials.
I belive that instead of forcibly setting verify=False, this should be a configuration option that is passed to ChannelFinderClient, just like the BaseURL, username, and password. It would be optimal if the safe default value of True was used, but if there are worries about breaking backwards compatibility with existing code which expects the verification to be disabled, we could keep the default value of False for now.
While making this change, we can also simplify the code by setting session.verify instead of explicitly passing verify each time one of the methods of session is called.