Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

pip install requests[security] vs pip install requests: Difference

I am using Ubuntu 14.04 (Trusty Tahr) with Python version 2.7.6. Today, when I created a new virtualenv and tried doing pip install requests, I got the error InsecurePlatformWarning.

I resolved this issue by following the instructions in SSL InsecurePlatform error when using Requests package.

But I want to understand what is the actual difference between these two commands: pip install requests[security] and pip install requests.

  1. Why does the former install three additional packages?

  2. Are there any things that I need to take care about when I push the code to production?

  3. Do they both behave the same generally?

like image 788
Ymartin Avatar asked Aug 04 '15 14:08

Ymartin


People also ask

What is pip install Requests?

Pip install Requests into a Virtual Directory You can use pip to install a specific version of the Requests module into a Virtualenv environment for Python 2 or Venv for Python 3 projects.

Is Requests installed by default Python?

What is requests? Requests is an HTTP library for Python. Requests allows you to send HTTP/1.1 requests. Requests does not automatically come installed with Python.


1 Answers

Why does the former install 3 additional packages?

Using requests[security] instead of requests will install three additional packages:

  • pyOpenSSL
  • cryptography
  • idna

These are defined in extras_requires, as optional features with additional dependencies.

Are there any things that I need to take care about when I push the code to production?

You'd want to make sure that you are able to install those additional packages without any issues and that any changes to the way SSL connections work don't affect your usage.

Do they both behave the same generally?

Using these packages as opposed to the default standard library options will allow for more secure SSL connections.

For more information, here's the pull request where it was merged in and here is the issue where it was discussed.

(From the comments, for when GitHub goes away):

So right now the SSL connections when you use pyOpenSSL, ndg-httspclient, and pyasn1 are more secure than if you just use the stdlib options. However it's hard to actually remember those three things. It would be cool if requests would add an extra to it's setup.py so that people can install requests with betterssl (Donald Stufft)


Also by default requests can't connect to some sites on OS X because of ancient OpenSSL. Using the above 3 packages makes it possible. (Donald Stufft)

like image 58
citruspi Avatar answered Sep 21 '22 08:09

citruspi