[FeatureRequest] disabling tls verification via library / keyword argument instead of a hook

[MarvKler]

Hi!

I have started using the schemathesis library and it works great!

But in my case i had to disable the TLS verification, because i am executing the schemathesis tests against a local application without TLS certificates.
As of now, i had to write a custom hook in python to disable the TLS verification.

Question: Is there a way to extend your library to disable the TLS verification directly in the test suite via library or keyword arguments ?

[aaltat]

I could not find anything in the https://schemathesis.readthedocs.io/en/stable/ documentation that would allow this easily. The library uses PythonLibCore which could allow writing Python plugins, but I don’t yet see what that API should do, which is not already possible, example by the hooks. In any case even with the Python plugin API, users would end up writing same or at least similar code as hooks. That being said there are many sides of Schemathesis which I don’t yet know. Can you share your hook code? It would allow me to better understand what you actually did.

[MarvKler]

Below you can see the python hook.

(fair to say: its AI generated code)

import urllib3
import requests

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

_original_session_init = requests.Session.__init__
_original_session_request = requests.Session.request

def _patched_session_init(self, *args, **kwargs):
    """Patched Session __init__ to disable SSL verification"""
    _original_session_init(self, *args, **kwargs)
    self.verify = False

def _patched_session_request(self, method, url, **kwargs):
    """Patched Session request to force verify=False"""
    kwargs['verify'] = False
    return _original_session_request(self, method, url, **kwargs)

requests.Session.__init__ = _patched_session_init
requests.Session.request = _patched_session_request

[aaltat]

Ah, I see. You are using the hook import feature to monkey patch the requests. I understand your worry, because monkey patching is not (always) good idea. But just sets verify to False in the session. In this case, you could the feature in release 2.2.0 which added support for creating the session externally and using the session in the Call and Call And Validate keywords. Would that be better way for you?

[aaltat]

Did you have time to try out the session argument?

[MarvKler]

I didn't had the time yet, but will test it in the upcoming week.
Generally, the idea sounds good & applicable for me.

[aaltat]

Will I see you next week at https://www.robocon.io/ online?

[MarvKler]

Yes, I'll be there!

[MarvKler]

So, now i had some time to try it, but unfortunately it is not working - i have used the described approach from your keyword documentation except that i am using a local file for the API spec instead of an URL:

*** Settings ***
Name                OpenAPI Specification - Validation
Resource            ../helper/variables.resource
Library             GetSession.py
Library             RequestsLibrary
Library             SchemathesisLibrary
...                 path=${OPENAPI_SPEC_PATH}
...                 max_examples=1
Test Template       Wrapper


*** Test Cases ***
All Tests   # This test is deleted by DataDriver
    test_case_1


*** Keywords ***
Wrapper
    [Documentation]    Wrapper keyword for the schemathesislibrary
    [Arguments]    ${case}

    Create Session    api-validation-session    ${CONNECTOR_BASE_URL}    verify=${False}
    ${session} =    Get Request Session
    Call And Validate    ${case}    session=${session}

from robot.libraries.BuiltIn import BuiltIn

def get_request_session():
    request_library = BuiltIn().get_library_instance("RequestsLibrary")
    return request_library._cache.current

But i am getting the following error for all generated test cases:

InvalidSchema: No connection adapters were found for 'file:///api/v1/health'

[aaltat]

When reading from a file, the url how API is called is lost. Use the base_url argument in Call* keywords to compensate

[MarvKler]

I've added the base_url.

I've also added a GET On Session keyword call on a known endpoint to verify the previously created session & this GET request does work, but the keyword Call And Validate does always fail with the error message below.

Wrapper
    [Documentation]    Wrapper keyword for the schemathesislibrary
    [Arguments]    ${case}

    Create Session    oc    ${CONNECTOR_BASE_URL}    verify=${False}    disable_warnings=${True}
    GET On Session     oc    /.things
    ${session} =    Get Request Session
    Call And Validate    ${case}    base_url=${CONNECTOR_BASE_URL}    session=${session}

Error:

Keyword failed: SSLError: HTTPSConnectionPool(host='localhost', port=48443): Max retries exceeded with url: /<my-endpoint>/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1000)')))

[MarvKler]

I did a little research & found the following:
In this file requests.py they are somehow setting / patching the verify parameter - do you think this overrides my verify=False config from the created session object ?

[aaltat]

Well it’s possible, but to be sure would need to look with debugger what code actually does. Because robocon online is going on, I don’t have time to look at it right now.

[MarvKler]

No worries, take your time!