Python - Requests Library - How to ensure HTTPS requests

Question

This is probably a dumb question, but I just want to make sure with the below.

I am currently using the requests library in python. I am using this to call an external API hosted on Azure cloud.

If I use the requests library from a virtual machine, and the requests library sends to URL: https://api-management-example/run, does that mean my communication to this API, as well as the entire payload I send through is secure? I have seen in my Python site-packages in my virtual environment, there is a cacert.pem file. Do I need to update that at all? Do I need to do anything else on my end to ensure the communication is secure, or the fact that I am calling the HTTPS URL means it is secure?

Any information/guidance would be much appreciated.

Thanks,

Answer 1

1. A HTTPS is secure with valid signed certificate. Some people use self signed certificate to maintain HTTPS. In requests library, you explicitly verify your certificate. If you have self-signed HTTPS then, you need to pass the certificate to cross verify with your local certificate.

• verify = True

import requests

response = requests.get("https://api-management-example/run", verify=True)

• Self Signed Certificate

import requests

response = requests.get("https://api-management-example/run", verify="/path/to/local/certificate/file/")

Answer 2

Post requests are more secure because they can carry data in an encrypted form as a message body. Whereas GET requests append the parameters in the URL, which is also visible in the browser history, SSL/TLS and HTTPS connections encrypt the GET parameters as well. If you are not using HTTPs or SSL/TSL connections, then POST requests are the preference for security. A dictionary object can be used to send the data, as a key-value pair, as a second parameter to the post method.

The HTTPS protocol is safe provided you have a valid SSL certificate on your API. If you want to be extra safe, you can implement end-to-end encryption/cryptography. Basically converting your so called plaintext, and converting it to scrambled text, called ciphertext.

Answer 3

You can explicitly enable verification in requests library:

import requests

session = requests.Session()
session.verify = True
session.post(url='https://api-management-example/run', data={'bar':'baz'})

This is enabled by default. you can also verify the certificate per request:

requests.get('https://github.com', verify='/path/to/certfile')

Or per session:

s = requests.Session()
s.verify = '/path/to/certfile'

Read the docs.