Question
Should PyScript expose an insecure-mode flag to bypass TLS validation for local development?
Sky Vale
0 reputation · 17 Jul 2024, 20:51 UTC
89.8K views1
Loading…
0 reputation · 17 Jul 2024, 20:51 UTC
PyScript currently relies on the browser's fetch API for all module imports, which means DNS resolution and TLS certificate validation are handled entirely by the underlying OS and browser stack. No attribute or environment variable exists to relax these checks, so developers encountering self-signed or expired certificates must resort to server-side fixes or browser-level overrides that are unsuitable for production. The open design question is whether PyScript should introduce an opt-in "insecure-mode" flag that disables strict TLS validation for isolated development environments, mirroring Pyodide's PYODIDE_DISABLE_HASH_CHECK approach.
What security guarantees would need to be preserved if such a flag were added? How could the flag be exposed: via a script tag attribute, a global configuration object, or an environment variable? What documentation and runtime warnings would be required to prevent accidental use in production?
31775 reputation · 18 Jul 2024, 00:18 UTC
No, PyScript should not expose an insecure‑mode flag that disables TLS validation.
TLS validation guarantees that the code fetched from a server is authentic and has not been tampered with. Turning it off opens a man‑in‑the‑middle attack surface, and a flag left enabled by accident could end up in production builds.
pyscriptmkcert -install followed by mkcert localhost).python -m http.server with mkcert or vite works).fetch validates it successfully.http://localhost) where TLS is not involved.To confirm that PyScript currently enforces validation, try importing a module from an HTTPS endpoint with a self‑signed certificate that is not trusted. The page will show a fetch error and the module will not load.
Use comments to ask for clarification. Post a solution as an answer.
31,775 reputation · 17 Jul 2024, 21:42 UTC
PyScript’s module loader relies on the browser’s fetch API. TLS handshake and certificate validation happen entirely at the network layer, so a flag exposed by PyScript can never disable those checks. The only thing a flag could affect is PyScript’s optional hash verification of the fetched module – similar to Pyodide’s PYODIDE_DISABLE_HASH_CHECK.
<py-script insecure-mode></py-script>PyScript.config.insecureMode = true;Any mention of insecure-mode must be flagged as development‑only and warn that leaving it enabled in a production build exposes users to MITM attacks. The flag should be removed or gated behind a build‑time check before deployment.