Requests: Requests does not support session key logging

[wittrup]

I would really like requests to support session key logging. Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic. This makes it easy to analyze traffic with Wireshark.
Requests should write symmetric session keys to the file set in user variable “SSLKEYLOGFILE”.

[Lukasa]

Requests cannot do this in normal operation because OpenSSL does not expose appropriate APIs to extract this keying information. Both Chrome and Firefox use other TLS implementations (BoringSSL and NSS) which do have the appropriate APIs.

I am currently working on a patch to enable this functionality in openssl/openssl#1646. Please track that issue, as until it merges it will not be possible for Requests to support this function. It will also be limited to OpenSSL 1.1.0 and modern Python versions.

[wenqiangwang]

Hi Cory, it seems your change has been merged to OpenSSL. Is the key logging supported in requests now?

[Lukasa]

Nope. Adding support for this requires first that OpenSSL 1.1.1 be released, and second that bindings for these functions be added to our dependencies. When OpenSSL 1.1.1 releases I'll add bindings to PyOpenSSL, but the stdlib will take a long time to catch up.

[g2p]

OpenSSL 1.1.1 is out!
News on the dependencies front?

[sigmavirus24]

Better to ask pyOpenSSL if they support it yet. Then convince urllib3 to expose a way to utilize it from their pyOpenSSL shim. .... Then it will be actually useful to bug us about how to use it within requests.

[pydlv]

Is this feature available yet in requests? It seems to still not be respecting the environment variable, but maybe I am just overlooking something? It would provide a very easy way to debug some of the requests in my script.

Also found this: https://bugs.python.org/issue34271

[gtors]

Just use https://pypi.org/project/sslkeylog/, it works for me.

[butlerrscott]

@gtors
I've tried the sslkeylog (0.2.0) module but with mixed success. A line is written into the sslkeylog.log file for each request.{get/put} but wireshark only seems to recognize and use some of them. For example, if my code has six requests.get() calls, six entries will be written to sslkeylog.log but wireshark will only be able to decode, say, three of the calls in a trace.

I suspect this is because 'requests' uses 'pyopenssl' but that's just a guess. This code is beyond my python knowledge.

If anyone has a suggestion, I would love to hear it.

Thanks