# Is requests verify=False actually dangerous in a backend?

Yes. `verify=False` disables SSL certificate checking, which enables man-in-the-middle attacks: anyone on the network path between your backend and another service can **intercept and modify the traffic** - reading API keys, injecting malicious responses, or stealing data in transit. It is especially common in backends that were set up during development and never fixed for production.

**The rule:** always use `verify=True` (it is the default) for external calls. If the target has a valid certificate - and anything behind a modern CDN does - there is no excuse for turning it off.

**The one legitimate case** is a Docker-internal call where services talk over the container network without TLS at all. Handle it explicitly rather than globally: keep an internal URL in its own variable and skip verification *only* when that internal address is the one being used. Then internal calls use Docker networking and every external call still verifies. What you must not do is reach for `verify=False` as a blanket setting because one internal call was awkward.

**The correlation worth knowing** when you are auditing: `verify=False` and empty API-key defaults tend to travel together. Backends with one usually have the other, because both come from the same "get it working locally" moment that never got cleaned up. If you see `verify=False` in review, check the API key handling in the same pass.

Full item: [https://www.tigzig.com/security/backend](https://www.tigzig.com/security/backend). Related: [https://www.tigzig.com/agents-faq/what-do-i-need-to-secure-on-a-backend-api](https://www.tigzig.com/agents-faq/what-do-i-need-to-secure-on-a-backend-api).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/is-verify-false-actually-dangerous
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms