[HttpClient] Add option crypto_method to set the minimum TLS version and make it default to v1.2
#50274
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GrahamCampbell
suggested changes
May 9, 2023
GrahamCampbell
suggested changes
May 9, 2023
GrahamCampbell
suggested changes
May 9, 2023
fa841e4 to
1f0dbc9
Compare
368b912 to
38f0aa1
Compare
|
I don't see where you actually configure the min TLS version of the amp/socket TLS context in this PR. Is this actually implemented in this PR ? |
src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
Outdated
Show resolved
Hide resolved
nicolas-grekas
commented
May 9, 2023
| @@ -141,6 +142,7 @@ private function getClient(array $options): array | |||
| $options['local_cert'] && $context = $context->withCertificate(new Certificate($options['local_cert'], $options['local_pk'])); | |||
| $options['ciphers'] && $context = $context->withCiphers($options['ciphers']); | |||
| $options['capture_peer_cert_chain'] && $context = $context->withPeerCapturing(); | |||
| $options['crypto_method'] && $context = $context->withMinimumVersion($options['crypto_method']); | |||
There was a problem hiding this comment.
@stof this is the line you're looking for
38f0aa1 to
8b50c6d
Compare
crypto_method to set the minimum SSL version and make it default to TLSv1.2crypto_method to set the minimum TLS/SSL version and make it default to TLSv1.2
crypto_method to set the minimum TLS/SSL version and make it default to TLSv1.2crypto_method to set the minimum SSL/TLS version and make it default to TLSv1.2
8b50c6d to
8cd0cea
Compare
|
PR updated to target 6.3 in case we'd like to merge it now. Status: needs review |
crypto_method to set the minimum SSL/TLS version and make it default to TLSv1.2crypto_method to set the minimum TLS version and make it default to TLSv1.2
8cd0cea to
bd38bbd
Compare
crypto_method to set the minimum TLS version and make it default to TLSv1.2crypto_method to set the minimum TLS version and make it default to v1.2
bd38bbd to
7d67194
Compare
…n and make it default to v1.2
7d67194 to
a9f25a1
Compare
fabpot
approved these changes
May 12, 2023
|
Thank you @nicolas-grekas. |
Merged
|
FYI, this has now similarly been implemented in Guzzle 7.6.0, though without the change to the default, not just because I feel it is arguably breaking, but also because Guzzle tends to have people using much older technology including versions of curl that may not even have the needed constant defined. |
nicolas-grekas
added a commit
that referenced
this pull request
Sep 28, 2024
…(HypeMC) This PR was merged into the 6.4 branch. Discussion ---------- [HttpClient] Add `crypto_method` to scoped client options | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | - | License | MIT While working on something else I've noticed that the `crypto_method` option wasn't added for scoped clients in #50274. I'm not sure if this was intentional or not, but as far as I can tell, there's no reason for the option to not be there, so I'm guessing it was an oversight. Commits ------- e274ee4 [HttpClient] Add `crypto_method` to scoped client options
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Idea borrowed from async-aws/aws#1402 by @GrahamCampbell
Note that Firefox/Chrome disabled support for TLS < 1.2 in 2020 and TLSv1.2 is available since 2008.