Ensure that SSL peers are verified

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > Règles SAST > Ensure that SSL peers are verified

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: php-security/curl-verify-peer

Language: PHP

Severity: Warning

Category: Security

CWE: 295

Description

This rule ensures that SSL peers are properly verified when making network requests using cURL in PHP. Verifying the SSL peer helps confirm that the server you are communicating with is authentic and prevents man-in-the-middle attacks.

To comply with this rule, always explicitly set curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, true); or curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 1); before executing your cURL requests. Avoid using any values that disable or bypass SSL verification. Adopting this practice ensures secure and trusted communication in your PHP applications.

Non-Compliant Code Examples

<?
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, NULL);
?>

Compliant Code Examples

<?
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, true);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 1);
?>