Azure / Azure/azure-sdk-for-python

Configuring a Global HTTPTransport Session For Enterprise Proxy

Open
#43,151 1 comment 0 reactions 0 assignees View on GitHub
Azure.Core Client customer-reported needs-team-attention question Service Attention
Dominant language
Python
Stars
5.6k
Forks
3.4k
Avg merge
1d 21h
Merged PRs (30d)
193

Description

- **Package Name**: azure-storage-blob
- **Package Version**: 12.26.0
- **Operating System**: Microsoft Windows 11 Enterprise

- **Python Version**: Python 3.13.2

**Describe the bug**
Similar to the user from #33607, we are behind a transparent network level corporate proxy. So when our applications make requests, the Proxy's SSL Certificate needs to be verified. Of course, the Proxy SSL Certificate is in the Windows Trust Store. Unfortunately, as I understand it depending the Python distribution, Python will not implicitly leverage the system Trust Store on Windows. In order for a Windows Python runtime to always load the system trust store, a user must create a default SSL context and load the default certificates like so

```python
ssl_context = ssl.create_default_context()
ssl_context.load_default_certs()
```
Now, I need to get this SSL Context into a Requests session so that it will validate my Proxy's certificate. I can accomplish that with the below
```python
class CustomSSLAdapter(HTTPAdapter):
def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs):
self.poolmanager = PoolManager(
num_pools=connections,
maxsize=maxsize,
block=block,
ssl_context=ssl_context,
**pool_kwargs,
)

requests_session = requests.Session()
requests_session.mount("https://", CustomSSLAdapter())
```
Alright, so if inject this session in my transport I can finally use it in the client
```
transport = RequestsTransport(session=requests_session)
return BlobServiceClient(azure_storage_url, credential=azure_credentials, transport=transport)
```
It would be nice if there was an easy way to globally configure the entire Azure library to use this default transport!

Also, it wasn't easy to this out using the existing documentation. I assume configuring self signed certificates is probably pretty common, so maybe it would be nice to make the solution more apparent in the docs.

I hope this helps someone else!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.