Disabled TLS Validation (ARCH7119)

Key php.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Unconditionally disabling certificate or hostname validation defeats the authentication purpose of TLS. An attacker can sit in the middle (MITM), present a forged certificate, and read the traffic.

Incorrect

<?php
$response = $client->get('https://api.example.com', [
    'verify' => false, // certificate validation off
]);

Correct

<?php
$response = $client->get('https://api.example.com', [
    'verify' => true, // validate against the system CA bundle
]);

Fix

Always keep TLS certificate and hostname validation enabled; if a custom CA is required, pass the CA bundle path to verify.