{"id":"8626a88f67bbede9","repo":"redis/redis-py","slug":"invalid-ssl-verify-flag-flag-8626a8","errorCode":null,"errorMessage":"Invalid ssl verify flag: {flag}","messagePattern":"Invalid ssl verify flag: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"redis/connection.py","lineNumber":2305,"sourceCode":"\ndef to_bool(value):\n    if value is None or value == \"\":\n        return None\n    if isinstance(value, str) and value.upper() in FALSE_STRINGS:\n        return False\n    return bool(value)\n\n\ndef parse_ssl_verify_flags(value):\n    # flags are passed in as a string representation of a list,\n    # e.g. VERIFY_X509_STRICT, VERIFY_X509_PARTIAL_CHAIN\n    verify_flags_str = value.replace(\"[\", \"\").replace(\"]\", \"\")\n\n    verify_flags = []\n    for flag in verify_flags_str.split(\",\"):\n        flag = flag.strip()\n        if not hasattr(VerifyFlags, flag):\n            raise ValueError(f\"Invalid ssl verify flag: {flag}\")\n        verify_flags.append(getattr(VerifyFlags, flag))\n    return verify_flags\n\n\nURL_QUERY_ARGUMENT_PARSERS = {\n    \"db\": int,\n    \"socket_timeout\": float,\n    \"socket_connect_timeout\": float,\n    \"socket_read_size\": int,\n    \"socket_keepalive\": to_bool,\n    \"retry_on_timeout\": to_bool,\n    \"retry_on_error\": list,\n    \"max_connections\": int,\n    \"health_check_interval\": int,\n    \"ssl_check_hostname\": to_bool,\n    \"ssl_include_verify_flags\": parse_ssl_verify_flags,\n    \"ssl_exclude_verify_flags\": parse_ssl_verify_flags,\n    \"ssl_min_version\": int,","sourceCodeStart":2287,"sourceCodeEnd":2323,"githubUrl":"https://github.com/redis/redis-py/blob/da03cdc7e8731092b13e395605c3c1fb2de25de1/redis/connection.py#L2287-L2323","documentation":"Raised as a ValueError by parse_ssl_verify_flags (connection.py:2296-2307) when a flag token in ssl_include_verify_flags / ssl_exclude_verify_flags does not exist as an attribute on ssl.VerifyFlags. The function is registered in URL_QUERY_ARGUMENT_PARSERS (line 2321-2322), so it runs when these flags are supplied via a rediss:// URL query string.","triggerScenarios":"Passing a rediss:// URL containing ?ssl_include_verify_flags=VERIFY_BOGUS or a misspelled flag name. The function splits on commas, strips brackets, and calls hasattr(VerifyFlags, flag) for each token; any unknown name raises.","commonSituations":"Typos in flag names (e.g. VERIFY_X509_STRICK), flags from a different Python/OpenSSL version than the runtime supports, copy-pasting flags documented for another TLS library, passing the numeric value as a string instead of the symbolic name.","solutions":["Use only valid ssl.VerifyFlags names (e.g. VERIFY_X509_STRICT, VERIFY_X509_TRUSTED_FIRST, VERIFY_X509_PARTIAL_CHAIN). Inspect with `python -c \"import ssl; print([n for n in dir(ssl.VerifyFlags) if n.startswith('VERIFY')]\"`.","Multiple flags are comma-separated in the URL: ?ssl_include_verify_flags=VERIFY_X509_STRICT,VERIFY_X509_PARTIAL_CHAIN.","If passing programmatically (not via URL), pass the ssl.VerifyFlags constants directly in a list rather than strings."],"exampleFix":"# before\nurl = \"rediss://h:6379?ssl_include_verify_flags=VERIFY_X509_TRUSTEDFIRST\"\nredis.Redis.from_url(url)\n\n# after (correct name)\nurl = \"rediss://h:6379?ssl_include_verify_flags=VERIFY_X509_TRUSTED_FIRST\"\n# or programmatically\nimport ssl\nredis.Redis.from_url(\"rediss://h\", ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_TRUSTED_FIRST])","handlingStrategy":"validation","validationCode":"import ssl\nVALID_FLAGS = {n for n in dir(ssl.VerifyFlags) if n.startswith(\"VERIFY\")}\n\ndef validate_flag_list(raw: str):\n    tokens = [t.strip() for t in raw.replace(\"[\",\"\").replace(\"]\",\"\").split(\",\") if t.strip()]\n    bad = [t for t in tokens if t not in VALID_FLAGS]\n    if bad:\n        raise ValueError(f\"Unknown ssl verify flags: {bad}; valid: {sorted(VALID_FLAGS)}\")\n    return tokens\n\nurl = f\"rediss://h?ssl_include_verify_flags={','.join(validate_flag_list(raw))}\"","typeGuard":"import ssl\ndef is_valid_verify_flag(name: str) -> bool:\n    return hasattr(ssl.VerifyFlags, name)","tryCatchPattern":"try:\n    client = redis.Redis.from_url(url_with_flags)\nexcept ValueError as e:\n    if \"Invalid ssl verify flag\" in str(e):\n        # strip the offending flag from the URL or pass constants directly\n        client = redis.Redis.from_url(\"rediss://h\", ssl_include_verify_flags=[ssl.VerifyFlags.VERIFY_X509_STRICT])\n    else:\n        raise","preventionTips":["Enumerate valid flags at runtime from ssl.VerifyFlags rather than hardcoding names.","Pass ssl.VerifyFlags constants in a list when configuring programmatically instead of URL strings.","Unit-test flag config against the target Python/OpenSSL version."],"tags":["ssl","configuration","validation","url-parsing"],"analyzedSha":"da03cdc7e8731092b13e395605c3c1fb2de25de1","analyzedAt":"2026-08-04T20:26:47.563Z","schemaVersion":2}