8000 [Fix] Make overriding TLS verification optional · arangodb/python-arango@c291667 · GitHub
[go: up one dir, main page]
Skip to content

Commit c291667

Browse files
aquamatthiasaquamatthias
committed
[Fix] Make overriding TLS verification optional
1 parent fd21695 commit c291667

File tree

3 files changed

+26
-12
lines changed

3 files changed

+26
-12
lines changed

‎arango/client.py

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,13 @@ class ArangoClient:
4545
the de-serialized object. If not given, ``json.loads`` is used by
4646
default.
4747
:type deserializer: callable
48-
:param verify_certificate: Verify TLS certificates.
49-
:type verify_certificate: bool
48+
:param verify_override: Override TLS certificate verification. This will
49+
override the verify method of the underlying HTTP client.
50+
None: Do not change the verification behavior of the underlying HTTP client.
51+
True: Verify TLS certificate using the system CA certificates.
52+
False: Do not verify TLS certificate.
53+
str: Path to a custom CA bundle file or directory.
54+
:type verify_override: Union[bool, str, None]
5055
"""
5156

5257
def __init__(
@@ -57,7 +62,7 @@ def __init__(
5762
http_client: Optional[HTTPClient] = None,
5863
serializer: Callable[..., str] = lambda x: dumps(x),
5964
deserializer: Callable[[str], Any] = lambda x: loads(x),
60-
verify_certificate: bool = True,
65+
verify_override: Union[bool, str, None] = None,
6166
) -> None:
6267
if isinstance(hosts, str):
6368
self._hosts = [host.strip("/") for host in hosts.split(",")]
@@ -79,9 +84,10 @@ def __init__(
7984
self._deserializer = deserializer
8085
self._sessions = [self._http.create_session(h) for h in self._hosts]
8186

82-
# set flag for SSL/TLS certificate verification
83-
for session in self._sessions:
84-
session.verify = verify_certificate
87+
# override SSL/TLS certificate verification if provided
88+
if verify_override is not None:
89+
for session in self._sessions:
90+
session.verify = verify_override
8591

8692
def __repr__(self) -> str:
8793
return f"<ArangoClient {','.join(self._hosts)}>"

‎docs/certificates.rst

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,20 @@ By default, self-signed certificates will cause trouble when connecting.
99
1010
client = ArangoClient(hosts="https://localhost:8529")
1111
12-
In order to make connections work even when using self-signed certificates, the
13-
`verify_certificates` option can be disabled when creating the `ArangoClient`
14-
instance:
12+
To make connections work even when using self-signed certificates, you can
13+
provide the certificate CA bundle or turn the verification off.
14+
15+
If you want to have fine-grained control over the HTTP connection, you should define
16+
your HTTP client as described in the :ref:`HTTPClients` section.
17+
18+
The ``ArangoClient`` class provides an option to override the verification behavior,
19+
no matter what has been defined in the underlying HTTP session.
20+
You can use this option to disable verification or provide a custom CA bundle without
21+
defining a custom HTTP Client.
1522

1623
.. code-block:: python
1724
18-
client = ArangoClient(hosts="https://localhost:8529", verify_certificate=False)
25+
client = ArangoClient(hosts="https://localhost:8529", verify_override=False)
1926
2027
This will allow connecting, but the underlying `urllib3` library may still issue
2128
warnings due to the insecurity of using self-signed certificates.
@@ -26,5 +33,4 @@ application:
2633
.. code-block:: python
2734
2835
import requests
29-
requests.packages.urllib3.disable_warnings()
30-
36+
requests.packages.urllib3.disable_warnings()

‎docs/http.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _HTTPClients:
2+
13
HTTP Clients
24
------------
35

0 commit comments

Comments
 (0)
0