Option for XMLPRC Server to support HTTPS

[rhettinger]

BPO	13403
Nosy	@loewis, @rhettinger, @pitrou, @tiran, @florentx
Files	ssl_xmlrpc_server.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2011-11-14.17:29:26.540>
labels = ['3.7', 'type-feature', 'library']
title = 'Option for XMLPRC Server to support HTTPS'
updated_at = <Date 2017-09-06.14:59:33.851>
user = 'https://github.com/rhettinger'

bugs.python.org fields:

activity = <Date 2017-09-06.14:59:33.851>
actor = 'christian.heimes'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2011-11-14.17:29:26.540>
creator = 'rhettinger'
dependencies = []
files = ['27773']
hgrepos = []
issue_num = 13403
keywords = ['patch']
message_count = 6.0
messages = ['147622', '171264', '174090', '174102', '275021', '301477']
nosy_count = 7.0
nosy_names = ['loewis', 'rhettinger', 'pitrou', 'christian.heimes', 'flox', 'mcjeff', 'fweimer']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'needs patch'
status = 'open'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue13403'
versions = ['Python 3.7']

[rhettinger]

The xmlrpc.client module supports secure transport using https; however, the xmlrpc.server does not have an https option.

Adding this support isn't difficult. Here's an example of how to it could be implemented: http://code.activestate.com/recipes/496786-simple-xml-rpc-server-over-https/

[pitrou]

Note there's already a couple of HTTPS servers in Lib/test/ssl_servers.py.
I'm not sure there's anything special to do for XMLRPC except to take the core instantiation code and put it in xmlrpclib.

[mcjeff]

I've hacked this support in myself a few times with a simple socket wrap call in SimpleXMLRPCServer's __init__. I'd be happy to put a quick patch together if that's a viable approach.

Is there any desire to support client authentication or advanced features like that? Or, are we simply looking for encryption?

[mcjeff]

Attached... worked in the way I've done it in the past and updated documents.

[tiran]

The patch is out of date. The XMLRPC HTTPS server should accept a ssl context instead of key and cert file. This allows better customization and SSL session resumption.

[tiran]

This issue hasn't seen any serious activity in five years. The patch is outdated, too. Is anybody interested to take it?