This project is archived and is in readonly mode.

#781 ✓duplicate

ActiveResource should allow SSL verification

Reported by rcoder | August 8th, 2008 @ 12:33 AM | in 2.x

As shipped right now, all ARes clients are subject to man-in-the-middle attacks by any server claiming to be a trusted API provider. We're using ActiveResource in some security-sensitive internal applications, and the lack of SSL certificate verification is worrisome.

I understand that configuring OpenSSL to properly verify all certificates in an application may be too high a barrier for some applications, but it would be preferable to at least have the option to override the default 'trust anyone' setting made in active_resource/connection.rb.

I've attached a simple patch against the current edge tree as an example; the particular configuration variable name is less important to me than the ability to turn on certificate verification in cases where the certificate infrastructure allows it.

Comments and changes to this ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

<h2 style="font-size: 14px">Tickets have moved to Github</h2>

The new ticket tracker is available at <a href=""></a>


Referenced by