From 07c3e8c9e04b15653e39b6dcb66c22e08b1c9336 Mon Sep 17 00:00:00 2001 From: yhirose Date: Fri, 16 Oct 2026 16:39:00 -0400 Subject: [PATCH] Set the client verify mode under the context lock On Mbed TLS and wolfSSL the verification mode is a setting of the context, and it was changed outside the lock that guards creating a session from that context. --- httplib.h | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/httplib.h b/httplib.h index 70e51cec..f2916bd7 100644 --- a/httplib.h +++ b/httplib.h @@ -11187,21 +11187,21 @@ inline bool setup_client_tls_session( !options.server_certificate_verifier_set; #endif -#if defined(CPPHTTPLIB_MBEDTLS_SUPPORT) || defined(CPPHTTPLIB_WOLFSSL_SUPPORT) - // Mbed TLS and wolfSSL need the verification mode set explicitly; OpenSSL - // uses SSL_VERIFY_NONE and does all verification post-handshake. Unless - // Schannel verifies the chain instead, chain verification happens during - // the handshake even for IP hosts; the certificate identity is verified - // post-handshake via verify_hostname(). - set_verify_client(ctx, - server_certificate_verification && !windows_verifies_chain); -#endif - { std::unique_lock guard; if (options.ctx_mutex) { guard = std::unique_lock(*options.ctx_mutex); } +#if defined(CPPHTTPLIB_MBEDTLS_SUPPORT) || defined(CPPHTTPLIB_WOLFSSL_SUPPORT) + // Mbed TLS and wolfSSL need the verification mode set explicitly, on the + // context, so under the same lock; OpenSSL uses SSL_VERIFY_NONE and does + // all verification post-handshake. Unless Schannel verifies the chain + // instead, chain verification happens during the handshake even for IP + // hosts; the certificate identity is verified post-handshake via + // verify_hostname(). + set_verify_client(ctx, server_certificate_verification && + !windows_verifies_chain); +#endif session = create_session(ctx, sock); } if (!session) { return fail(Error::SSLConnection, 0, get_error()); }