HTTPoison vs HTTPotion

[OvermindDL1]

@voltone

HTTPoison (actually, Hackney) comes with secure HTTPS defaults. Last time I checked other HTTP clients, including HTTPotion/iBrowse, will happily let you pass in an HTTPS URL and connect to the server without any verification of the server’s certificate chain or identity (hostname). Basically they obscure the communication to avoid eavesdropping, but they don’t protect against MitM attacks unless you explicitly pass in all the right TLS configuration options.

I can attest to this. We have a Ubiquity thing here that mandates HTTPS for its api connection, but it uses a self-signed cert, thus I had to disable HTTPoisons/Hackneys checking. ^.^