Aller au contenu
AppArch AppArch Docs

TLS validation disabled (ARCH2119)

Ce contenu n’est pas encore disponible dans votre langue.

Key python.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Unconditionally bypassing TLS certificate or hostname validation defeats the authentication guarantee of TLS. This enables man-in-the-middle attacks and silent eavesdropping on traffic.

Incorrect

Section titled “Incorrect”
import requests


resp = requests.get("https://api.example.com/data", verify=False)

Correct

Section titled “Correct”
import requests


resp = requests.get("https://api.example.com/data", verify=True)
# For a private CA: verify="/etc/ssl/certs/internal-ca.pem"

Fix

Section titled “Fix”

Keep certificate validation enabled; for a private CA, pass the CA bundle to verify.