SSL InsecurePlatform error when using Requests package
Use the somewhat hidden security feature:
pip install requests[security]
orpip install pyOpenSSL ndg-httpsclient pyasn1
Both commands install following extra packages:
- pyOpenSSL
- cryptography
- idna
Please note that this is not required for python-2.7.9+.
If pip install
fails with errors, check whether you have required development packages for libffi
, libssl
and python
installed in your system using distribution's package manager:
Debian/Ubuntu -
python-dev
libffi-dev
libssl-dev
packages.Fedora -
openssl-devel
python-devel
libffi-devel
packages.
Distro list above is incomplete.
Workaround (see the original answer by @TomDotTom):
In case you cannot install some of the required development packages, there's also an option to disable that warning:
import requests.packages.urllib3
requests.packages.urllib3.disable_warnings()
If your pip
itself is affected by InsecurePlatformWarning
and cannot install anything from PyPI, it can be fixed with this step-by-step guide to deploy extra python packages manually.
pip install requests[security] vs pip install requests: Difference
Why does the former install 3 additional packages?
Using requests[security]
instead of requests
will install three additional packages:
- pyOpenSSL
- cryptography
- idna
These are defined in extras_requires
, as optional features with additional dependencies.
Are there any things that I need to take care about when I push the code to production?
You'd want to make sure that you are able to install those additional packages without any issues and that any changes to the way SSL connections work don't affect your usage.
Do they both behave the same generally?
Using these packages as opposed to the default standard library options will allow for more secure SSL connections.
For more information, here's the pull request where it was merged in and here is the issue where it was discussed.
(From the comments, for when GitHub goes away):
So right now the SSL connections when you use pyOpenSSL, ndg-httspclient, and pyasn1 are more secure than if you just use the stdlib options. However it's hard to actually remember those three things. It would be cool if requests would add an extra to it's setup.py so that people can install requests with betterssl (Donald Stufft)
Also by default requests can't connect to some sites on OS X because of ancient OpenSSL. Using the above 3 packages makes it possible. (Donald Stufft)
Related Topics
How to Implement the Softmax Function in Python
Sorting by a Custom List in Pandas
How to Fix "Importerror: No Module Named ..." Error in Python
How to Create an Encrypted Zip File
Count Consecutive Occurences of Values Varying in Length in a Numpy Array
How to Change Plot Background Color
How to Increment a Datetime by One Day
Is It Feasible to Compile Python to MAChine Code
Record Speakers Output with Pyaudio
Import a Python Module Without the .Py Extension
Ssl Insecureplatform Error When Using Requests Package
Pandas Dataframe Concat VS Append
Python Accessing Nested JSON Data
How to Set Folder Permissions in Windows
Reactornotrestartable Error in While Loop with Scrapy