Ability to "pin" TLS version and/or ciphers about threema-msgapi-sdk-python HOT 2 CLOSED

I'm in two minds about this. Certainly, a developer should have this option, and in fact he has because no one is required to use this project as is. Then again, good TLS settings security change over time and there are plenty of misleading optimal settings out there. I'm quite sure that the developers of aiohttp take this as seriously as we do and they can use their knowledge to provide us sane and safe TLS settings.

I guess it would be okay to add an optional keyword argument connector to the class Connection which contains a aiohttp.BaseConnector instance. But I wouldn't want to go any further. At least not without some very convincing arguments.

Nevertheless, if somebody wants to do it, the following should work (TLS settings from this page). I have not tested this and I'm definitely not recommending it!

import ssl
import aiohttp

from threema import gateway


class Connection(gateway.Connection):
    def __init__(self, *args, fingerprint=None, verify_fingerprint=False, **kwargs):
        super().__init__(*args, fingerprint=fingerprint,
                         verify_fingerprint=verify_fingerprint, **kwargs)

        # Create your own SSL context here...
        ssl_context = ssl.create_default_context()

        # Override session
        if fingerprint is None and verify_fingerprint:
            fingerprint = self.fingerprint
        connector = aiohttp.TCPConnector(fingerprint=fingerprint, ssl_context=ssl_context)
        self._session = aiohttp.ClientSession(connector=connector)

from threema-msgapi-sdk-python.

Yes I would also only make it optional (that's why I said "ability" 😃), so that the user can choose for him/herself the best ciphers and therefore he should know that this might need to be updated at some time.

from threema-msgapi-sdk-python.