Session.verify=False ignored when REQUESTS_CA_BUNDLE environment variable is set
Open
Nobody has claimed this yet.
Bug
Planned
- Dominant language
- Python
- Stars
- 54.3k
- Forks
- 10.4k
- Avg merge
- 16h 43m
- Merged PRs (30d)
- 3
Description
One would expect that when the caller explicitly asks to make unverified requests, then the REQUESTS_CA_BUNDLE environment variable doesn't affect it. The reality is different, however.
import os
import requests
os.environ['REQUESTS_CA_BUNDLE'] = 'asd.pem' # Must be an existing file
r = requests.get('https://self-signed.badssl.com/', verify=False)
print(r)
# Prints: <Response [200]>
session = requests.Session()
session.verify = False
r = session.get('https://self-signed.badssl.com/')
print(r)
# Fails: requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reproducer in the issue and trace how Session.get handles session.verify alongside REQUESTS_CA_BUNDLE. Identify where the environment setting overrides the explicit session option, then add coverage for this scenario. Done means a session with verify=False succeeds without using REQUESTS_CA_BUNDLE, while the existing request behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100