Ymartin Ymartin - 3 months ago 11
Python Question

pip install requests[security] vs pip install requests: Difference

I am using Ubuntu 14.04 with python version 2.7.6. Today, when I created a new

virtualenv
and tried doing
pip install requests
, I got the error
InsecurePlatformWarning
.

I resolved this issue by following the instructions over here

SSL InsecurePlatform error when using Requests package

But I want to understand what is the actual difference between these two commands:
pip install requests[security]
and
pip install requests
.

1) Why does the former install 3 additional packages?

2) Are there any things that I need to take care about when I push the code to production?

3) Do they both behave the same generally?

I searched a lot on stackoverflow and elsewhere, but couldn't find the answer. If it has already been answered then please post the link.

Thanks.

Answer

Why does the former install 3 additional packages?

Using requests[security] instead of requests will install three additional packages:

  • pyOpenSSL
  • ndg-httpsclient
  • pyasn1

These are defined in extras_requires, as optional features with additional dependencies.

Are there any things that I need to take care about when I push the code to production?

You'd want to make sure that you are able to install those additional packages without any issues and that any changes to the way SSL connections work don't affect your usage.

Do they both behave the same generally?

Using these packages as opposed to the default standard library options will allow for more secure SSL connections.

For more information, here's the pull request where it was merged in and here is the issue where it was discussed.

(From the comments, for when GitHub goes away):

So right now the SSL connections when you use pyOpenSSL, ndg-httspclient, and pyasn1 are more secure than if you just use the stdlib options. However it's hard to actually remember those three things. It would be cool if requests would add an extra to it's setup.py so that people can install requests with betterssl (Donald Stufft)


Also by default requests can't connect to some sites on OSX because of ancient OpenSSL. Using the above 3 packages makes it possible. (Donald Stufft)

Comments