Hi,

Whether curl does the ssl-pinning which can avoid "man in the middle
attack".
Does it do the strict validation. As explained in below link.
https://www.owasp.org/index.php/Pinning_Cheat_Sheet#OpenSSL

Because below comments of the function "servercert", it looks like it
handles the "man in the middle attack".
by setting CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER.
/*
 * Get the server cert, verify it and show it etc, only call failf() if the
 * 'strict' argument is TRUE as otherwise all this is for informational
 * purposes only!
 *
 * We check certificates to authenticate the server; otherwise we risk
 * man-in-the-middle attack.
 */

Should applications have to do anything extra for avoiding "man in the
middle attack"?

Thanks in advance.

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2013-07-25