3 ms·
Security note: Check out the following lines, taken from the PHP API client used by this application (https://github.com/jmathai/twitter-async/blob/master/EpiOA
by nbpoole 15y ago
Security note: Check out the following lines, taken from the PHP API client used by this application (https://github.com/jmathai/twitter-async/blob/master/EpiOAuth.php#L173 https://github.com/jmathai/twitter-async/blob/master/EpiOAut...):
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
Those lines disable certificate verification: if I can intercept the connection between this client and Twitter, I can present my own, self-signed certificate and the client will still send requests as if I were twitter.com. This completely defeats the purpose of using SSL for connections.
- jmathai 15y agoNot sure if you've had a somewhat popular library on Github but those two lines of code save me lots and lots of issues being opened because the library didn't work out of the box. Perhaps I could add an optional setting to include those lines of code...but that's the beauty of open source -- so can you :).