Libravatar (obsolete)

Check browserid.org verifier's SSL certificate

Bug #864464 reported by François Marier
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Libravatar (obsolete)
Fix Released
High
François Marier

Bug Description

urllib2 doesn't check that the server SSL certificate is valid when connecting to an HTTPS host.

Instead, we should use HttpLib2:

  https://code.google.com/p/httplib2/

Unfortunately the Squeeze version of python-httplib2 is too old and doesn't support the cacerts parameter :(

Revision history for this message
François Marier (fmarier) wrote :

This will be unnecessary once bug 859354 is fixed.

Revision history for this message
François Marier (fmarier) wrote :

Another module worth looking at (that's the one that django-browserid now uses) is requests:

  http://pypi.python.org/pypi/requests

Revision history for this message
François Marier (fmarier) wrote :

python-requests is available in squeeze-backports:

  http://packages.debian.org/squeeze-backports/python-requests

Changed in libravatar:
assignee: nobody → François Marier (fmarier)
François Marier (fmarier)
Changed in libravatar:
status: Triaged → In Progress
François Marier (fmarier)
Changed in libravatar:
status: In Progress → Fix Committed
François Marier (fmarier)
Changed in libravatar:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.