-
Notifications
You must be signed in to change notification settings - Fork 171
Open
Description
By the looks of it ( https://github.com/bitbucket-rest-api/bitbucket/blob/master/lib/bitbucket_rest_api/connection.rb#L32 ), by default SSL verification is turned off in the gem.
This is greatly discouraged practice ( see Solutions To Avoid https://github.com/lostisland/faraday/wiki/Setting-up-SSL-certificates ), as we now have the same guarantees about validity of our peer as if we were to use an HTTP connection.
I'd encourage for this gem to turn SSL verification on to guarantee peer validation in the default scenario and thus for it to be a secure default.
krames, scytherswings and iobajwa
Metadata
Metadata
Assignees
Labels
No labels