Allow requests.post(verify=) to be controlled

Author: Jc2k

README.md

@@ -116,6 +116,7 @@ The backend to connect to is controlled by these settings:
  * `TINYAUTH_ENDPOINT`: The `https://` endpoint to access to authorize a HTTP request.
  * `TINYAUTH_ACCESS_KEY_ID`: Access key for a tinyauth user with permission to authorize requests for this service.
  * `TINYAUTH_SECRET_ACCESS_KEY`: Secret key for this user
+ * `TINYAUTH_ENDPOINT_VERIFY`: Either a boolean, in which case it controls whether we verify the server's TLS certificate, or a string, in which case it must be a path to a CA bundle to use. Defaults to True.
 
 Each permission check is for a permission and an `arn` that globally identifies an instance of a resource. An arn is constructed in the following form:
 

flask_tinyauth/api.py

@@ -42,6 +42,7 @@ def call(api, request):
                 'Content-Type': 'application/json',
             },
             json=request,
+            verify=current_app.config.get('TINYAUTH_VERIFY', True),
         )
     except requests.exceptions.ConnectionError as e:
         logger.critical('Unable to connect to authentication backend', exc_info=e)