Skip to main content
7 events
when toggle format what by license comment
Jul 5, 2011 at 13:58 comment added Otto Well, anything that can get between your server and the server that it's contacting could potentially intercept the communication and replace it with something else. What the security implications of that are depends on what exactly you're sending/receiving between the servers.
Jul 4, 2011 at 22:07 comment added MikeSchinkel and @MeanderingCode - Gotcha, thanks! If this is code only running as a plugin then WiFi access points aren't really a problem, but a rogue ISP could be right? Security hasn't been my strength, but I'll get there.
Jul 4, 2011 at 21:23 comment added Otto The security implication is that you could be vulnerable to a man-in-the-middle attack, such as via DNS poisoning or a compromised WiFi access point. Basically, when you connect to api.example.com, then you have no way to know if that's really api.example.com you're talking to, or some other system pretending to be api.example.com. Without sslverify (in curl this is called CURLOPT_SSL_VERIFYPEER), then anybody could intercept your communications, pretend to be somebody they're not, and you have no way to tell. Verifying certificates eliminates this possibility.
S Jul 4, 2011 at 19:47 history suggested MeanderingCode CC BY-SA 3.0
I have no reputation and cannot comment on the answer, but would like to contribute an answer to MikeSchinkel's question
Jul 4, 2011 at 19:45 review Suggested edits
S Jul 4, 2011 at 19:47
Jul 4, 2011 at 19:16 comment added MikeSchinkel Great answer, thanks. Question: If someone is using the remote GET in a plugin to call a RESTful web service that is hosted by the developer of the plugin, do you see any potential issues for security there? For example, if an "ACME Plugin for WordPress" using wp_remote_get() on api.acme.com/stuff do you think there's any potential issue if we turn off 'sslverify'?
Jul 2, 2011 at 5:35 history answered Otto CC BY-SA 3.0