if i set the http_proxy* args to a https proxy, the connect to the proxy doesn't appear to be going over SSL. this leaks the proxy credentials over a plaintext channel. the underlying Net::HTTP.new appears to support p_use_ssl (8th positional argument) to enable this, however HTTParty doesn't appear to use it. just thought i'd let you know of this gap.
if i set the
http_proxy*args to a https proxy, the connect to the proxy doesn't appear to be going over SSL. this leaks the proxy credentials over a plaintext channel. the underlyingNet::HTTP.newappears to supportp_use_ssl(8th positional argument) to enable this, however HTTParty doesn't appear to use it. just thought i'd let you know of this gap.