# urls.py skips checks in SSLValidationHandler when server in no\_proxy list

**URL:** <https://forum.ansible.com/t/urls-py-skips-checks-in-sslvalidationhandler-when-server-in-no-proxy-list/31580>\
**Category:** Ansible Project\
**Created:** [October 31, 2019, 4:24pm UTC](https://forum.ansible.com/t/urls-py-skips-checks-in-sslvalidationhandler-when-server-in-no-proxy-list/31580 "2019-10-31T16:24:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Iero](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Alex\_Iero](https://forum.ansible.com/u/Alex_Iero)\
**Post date:** [October 31, 2019, 4:24pm UTC](https://forum.ansible.com/t/urls-py-skips-checks-in-sslvalidationhandler-when-server-in-no-proxy-list/31580/1 "2019-10-31T16:24:50Z")

</div>

I recently encountered [ansible#54589](https://github.com/ansible/ansible/issues/54589) with Ansible 2.8.1 where the uri module fails when a client cert is required by the server. While looking into [urls.py](https://github.com/ansible/ansible/blob/stable-2.8/lib/ansible/module_utils/urls.py) from the 2.8 release, I’ve noticed the following code in [SSLValidationHandler.http\_request](https://github.com/ansible/ansible/blob/stable-2.8/lib/ansible/module_utils/urls.py#L809):

`

# Detect if ‘no\_proxy’ environment variable is set and if our URL is included

use\_proxy = self.detect\_no\_proxy(req.get\_full\_url())

if not use\_proxy:

# ignore proxy settings for this host request

if tmp\_ca\_cert\_path:  
try:  
os.remove(tmp\_ca\_cert\_path)  
except OSError:  
pass  
if to\_add\_ca\_cert\_path:  
try:  
os.remove(to\_add\_ca\_cert\_path)  
except OSError:  
pass  
return req  
`

This code was introduced by [PR 9807](https://github.com/ansible/ansible/pull/9807).

The above code essentially skips the SSL validation performed by _ **SSLValidationHandler** _ for URLs where the host is part of the _ **no\_proxy** _ list. Effectively having the server in _ **no\_proxy** _, masks the issue reported by [ansible#54589](https://github.com/ansible/ansible/issues/54589).

Can someone posibly explain if it makes any sense for the above code to be part of _ **SSLValidationHandler** _?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [October 31, 2019, 6:06pm UTC](https://forum.ansible.com/t/urls-py-skips-checks-in-sslvalidationhandler-when-server-in-no-proxy-list/31580/2 "2019-10-31T18:06:41Z")

</div>

Yes, there was errant logic in that method. It was subsequently addressed in [https://github.com/ansible/ansible/pull/55953](https://github.com/ansible/ansible/pull/55953)

> Doesn’t effectively disable SSL verification if no\_proxy is true

The changes in that PR are too large for a backport, so the fixes will only appear in the 2.9.0 release which is slated for release today.

---

<div class="post-metadata">

**Author:** ![Alex\_Iero](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Alex\_Iero](https://forum.ansible.com/u/Alex_Iero)\
**Post date:** [November 1, 2019, 10:46am UTC](https://forum.ansible.com/t/urls-py-skips-checks-in-sslvalidationhandler-when-server-in-no-proxy-list/31580/3 "2019-11-01T10:46:18Z")

</div>

Awesome! Thanks for the reply.