Timeline for What is the relationship between cURL, WordPress and cacert.pem?
Current License: CC BY-SA 3.0
7 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jul 5, 2011 at 13:58 | comment | added | Otto | Well, anything that can get between your server and the server that it's contacting could potentially intercept the communication and replace it with something else. What the security implications of that are depends on what exactly you're sending/receiving between the servers. | |
Jul 4, 2011 at 22:07 | comment | added | MikeSchinkel | and @MeanderingCode - Gotcha, thanks! If this is code only running as a plugin then WiFi access points aren't really a problem, but a rogue ISP could be right? Security hasn't been my strength, but I'll get there. | |
Jul 4, 2011 at 21:23 | comment | added | Otto | The security implication is that you could be vulnerable to a man-in-the-middle attack, such as via DNS poisoning or a compromised WiFi access point. Basically, when you connect to api.example.com, then you have no way to know if that's really api.example.com you're talking to, or some other system pretending to be api.example.com. Without sslverify (in curl this is called CURLOPT_SSL_VERIFYPEER), then anybody could intercept your communications, pretend to be somebody they're not, and you have no way to tell. Verifying certificates eliminates this possibility. | |
S Jul 4, 2011 at 19:47 | history | suggested | MeanderingCode | CC BY-SA 3.0 |
I have no reputation and cannot comment on the answer, but would like to contribute an answer to MikeSchinkel's question
|
Jul 4, 2011 at 19:45 | review | Suggested edits | |||
S Jul 4, 2011 at 19:47 | |||||
Jul 4, 2011 at 19:16 | comment | added | MikeSchinkel |
Great answer, thanks. Question: If someone is using the remote GET in a plugin to call a RESTful web service that is hosted by the developer of the plugin, do you see any potential issues for security there? For example, if an "ACME Plugin for WordPress" using wp_remote_get() on api.acme.com/stuff do you think there's any potential issue if we turn off 'sslverify' ?
|
|
Jul 2, 2011 at 5:35 | history | answered | Otto | CC BY-SA 3.0 |