Why is it unsafe to use verify=False and synchronous requests in FastAPI?

Using verify=False in requests disables SSL certificate verification, making the connection vulnerable to "man-in-the-middle" attacks — an attacker can intercept or modify data.

In the context of FastAPI, if you make synchronous HTTP requests via requests inside asynchronous handlers, it blocks the event loop, reducing the application's performance and scalability.

Why is this bad:

• Security: verify=False disables server authenticity verification, which is dangerous in production.
• Performance: synchronous calls block the asynchronous thread, delaying the processing of other requests.

Recommendations:

• Always use SSL verification (do not set verify=False), or properly configure certificates.
• For asynchronous requests, use libraries like httpx with async support to avoid blocking the event loop.

Example of an asynchronous request with httpx:

import httpx

async def fetch_data():
    async with httpx.AsyncClient() as client:
        response = await client.get('https://example.com')
        return response.text