Metadata

ID: php-security/curl-verify-peer

Language: PHP

Severity: Warning

Category: Security

CWE: 295

Description

This rule ensures that SSL peers are properly verified when making network requests using cURL in PHP. Verifying the SSL peer helps confirm that the server you are communicating with is authentic and prevents man-in-the-middle attacks.

To comply with this rule, always explicitly set curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, true); or curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 1); before executing your cURL requests. Avoid using any values that disable or bypass SSL verification. Adopting this practice ensures secure and trusted communication in your PHP applications.

Non-Compliant Code Examples

<?
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, NULL);
?>

Compliant Code Examples

<?
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, true);
curl_setopt($handler, CURLOPT_SSL_VERIFYHOST, 1);
?>

Seamless integrations. Try Datadog Code Security

Datadog Code Security