romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 20:23:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

docs: mention indirect effects of --insecure

Browse source 
Warn users that disabling certficate verification allows servers to
"pollute" curl with data it trusts.

Reported-by: Harry Sintonen
Closes #10126
This commit is contained in:
Daniel Stenberg 2022-12-21 23:36:57 +01:00
parent 07dfbc08bf
commit ee583c68d4
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/cmdline-opts/insecure.d
View file

@ -26,3 +26,8 @@ For SFTP and SCP, this option makes curl skip the *known_hosts* verification.
".ssh" subdirectory, which contains host names and their public keys.
**WARNING**: using this option makes the transfer insecure.
When curl uses secure protocols it trusts responses and allows for example
HSTS and Alt-Svc information to be stored and used subsequently. Using
--insecure can make curl trust and use such information from malicious
servers.