requests icon indicating copy to clipboard operation
requests copied to clipboard

2.32.5 breaks passing custom SSL context

Open Tasssadar opened this issue 3 months ago • 0 comments

2.32.5 change https://github.com/psf/requests/commit/90fee0876aea97c639b3bf698d83a12876d2f160 breaks passing of custom ssl context using an adapter like this:

class SSLContextAdapter(requests.adapters.HTTPAdapter):
    @override
    def init_poolmanager(self, *args: Any, **kwargs: Any) -> Any:
        kwargs["ssl_context"] = ssl.create_default_context()
        return super().init_poolmanager(*args, **kwargs)  # type: ignore

ssl_adapter = SSLContextAdapter()
session.mount("https://", ssl_adapter)

Now, if verify=True, the code in https://github.com/psf/requests/blob/90fee0876aea97c639b3bf698d83a12876d2f160/src/requests/adapters.py#L292-L313 always sets ca_certs, which causes urllib3 to modify the ssl_context by loading more certs into it here.

EDIT: I can be fixed by overriding also cert_verify:

class SSLContextAdapter(requests.adapters.HTTPAdapter):
    @override
    def init_poolmanager(self, *args: Any, **kwargs: Any) -> Any:
        kwargs["ssl_context"] = ssl.create_default_context()
        return super().init_poolmanager(*args, **kwargs)  # type: ignore

    @override
    def cert_verify(self, *_args: Any, **_kwargs: Any) -> None:
        pass


ssl_adapter = SSLContextAdapter()
session.mount("https://", ssl_adapter)

I'd say this belongs to documentation and needs some tests, so that future changes don't break it again - will prepare a PR if I'll have time.

Tasssadar avatar Oct 06 '25 20:10 Tasssadar