Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix SSL verification error #6901

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

bughandler
Copy link

@bughandler bughandler commented Feb 19, 2025

This is a dedicated PR to fix #6900.

As I said in the issue, this looks like a bug of requests_toolbelt but turns out that it belongs to the requests itself.
Basically, what HostHeaderSSLAdapter does is quite simple:

    def send(self, request, **kwargs):
        # HTTP headers are case-insensitive (RFC 7230)
        host_header = None
        for header in request.headers:
            if header.lower() == "host":
                host_header = request.headers[header]
                break

        connection_pool_kwargs = self.poolmanager.connection_pool_kw

        if host_header:
            connection_pool_kwargs["assert_hostname"] = host_header
        elif "assert_hostname" in connection_pool_kwargs:
            # an assert_hostname from a previous request may have been left
            connection_pool_kwargs.pop("assert_hostname", None)

        return super(HostHeaderSSLAdapter, self).send(request, **kwargs)

As you can see, it simply set assert_hostname to the custom SNI for the urllib3.poolmanager.connection_pool_kw.

When the proxy is set, the function adapters.py!proxy_manager_for() forgets to copy the connection_pool_kwargs property from the current poolmanager, which will cause the SSL verification exception when the user is doing the request with the custom SNI and self-signed certificate.

PS: It's my first PR, sorry if my workflow doesn't meet your requirements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unable to request a private URL endpoint with custom SNI and self-signed CA when the proxy is set
1 participant