idna-ssl

library1.1.0pypypi✓ verified 21d ago

The `idna-ssl` library provides a patch for Python's standard `ssl.match_hostname` function to correctly support Unicode (IDNA) domains. It aims to offer backward compatibility for older Python versions (pre-3.7) where `ssl.match_hostname` had significant issues with internationalized domain names, and to address lingering IDNA2008 compliance problems even in later Python releases. The library's current version is 1.1.0, released in July 2018. The project's GitHub repository has been archived and is read-only since October 2020, indicating it is no longer actively maintained.

auth-security http-networking

pip install idna-ssl

github ↗package ↗

INSTALL

IMPORT

SIG · IDNA-SSL

idna-ssl

auth-securitypythonv1.1.0

Install

2.4s avg

Import

37ms

Disk

17MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.1.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.024s · 19.7MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.4s · import 0.020s · 20MB

17MB installed

● package 17MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

idna_ssl

✓ import idna_ssl

✗ import idna-ssl

The `patch_match_hostname()` function needs to be imported and called early in your application's lifecycle to apply the necessary fix globally. The example demonstrates its use with `aiohttp` to access a Unicode domain, which would otherwise fail hostname verification on affected Python versions.

from idna_ssl import patch_match_hostname import asyncio import aiohttp # Apply the patch globally as early as possible in your application patch_match_hostname() # Example usage with aiohttp accessing an IDNA domain URL = 'https://цфоут.мвд.рф/news/item/8065038/' async def main(): async with aiohttp.ClientSession() as session: async with session.get(URL) as response: print(f"Status: {response.status}") print(f"Content-Type: {response.headers.get('Content-Type')}") if __name__ == '__main__': # This example requires Python 3.7+ for asyncio.run() # For older Python versions, use loop = asyncio.get_event_loop(); loop.run_until_complete(main()) try: asyncio.run(main()) except RuntimeError: loop = asyncio.get_event_loop() loop.run_until_complete(main())

Debug

Known issues

breakingThe library applies a global monkey-patch to `ssl.match_hostname`. This can lead to unexpected behavior or conflicts if other libraries also attempt to modify `ssl.match_hostname` or rely on its unpatched behavior. Ensure compatibility with other dependencies.

fix

Thoroughly test your application's SSL/TLS interactions after applying the patch. Inspect call stacks if unexpected SSL errors occur to identify potential conflicts.

affects: All versions

deprecatedThe GitHub repository for `idna-ssl` was archived on October 22, 2020, making it read-only. This indicates the project is no longer actively maintained, and no further updates, bug fixes, or security patches will be provided. Users should be aware of the risks associated with using unmaintained software.

fix

Evaluate if the specific IDNA-related `ssl.match_hostname` issue you are facing is resolved in newer Python versions (3.7+ improved IDNA handling significantly). If possible, consider upgrading Python or finding alternative solutions for IDNA domain validation, such as explicitly using the `idna` library for encoding/decoding before passing to standard `ssl` functions where applicable.

affects: All versions (due to project status)

gotchaWhile Python 3.7 and later versions generally improved IDNA handling in `ssl.match_hostname`, the `idna-ssl` library's motivation states that 'IDNA2008 is still broken' even in Python 3.7. This suggests that `idna-ssl` specifically addresses IDNA2008 compliance beyond what the standard library provides, which can be a subtle distinction.

fix

Understand the specific IDNA specification (IDNA2003 vs. IDNA2008, UTS #46) relevant to your use case. If strict IDNA2008 compliance is critical for `ssl.match_hostname`, this library might still be necessary, but consider the 'abandoned' status.

affects: Python 3.7+ (for the 'still broken' aspect)

gotchaThe functionality of `ssl.match_hostname` itself has evolved, particularly concerning wildcard certificate matching, with security fixes (e.g., CVE-2013-7440). Relying on a globally patched version might obscure further security updates to the underlying `ssl` module in newer Python releases.

fix

Stay informed about Python's `ssl` module updates and security advisories. If patching, consider whether the patch might interfere with future security enhancements or changes in behavior in `ssl.match_hostname`.

affects: All versions

Upgrade

Version history

1.1.0latest on PyPI · released Jul 5, 2018

Audit

Dependencies

idnarequiredThis library patches SSL hostname matching for Internationalized Domain Names (IDNA). The underlying IDNA encoding/decoding is handled by the `idna` library (or the standard library's `encodings.idna`), which this package implicitly depends on for its functionality.

Agent activity

21 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/aio-libs/idna-ssl ↗

packagehttps://pypi.org/project/idna-ssl/ ↗