Add RequestBuilder methods to accept invalid TLS

[sbstp]

No description provided.

[sbstp]

#38

[sbstp]

I did some experiments with badssl.com, and I think that accept_invalid_certs might be a superset of accept_invalid_hostnames, so the third method that sets both would not be required. I'll look further into this.

[adamreichold]

This is nice! 👍

[adamreichold]

@sbstp I was thinking about this again and maybe we want to avoid adding nooks and crannies for all possible network scenarios to attohttpc's API, maybe we just need a public trait like

pub trait Streams {
   type Tcp: Read + Write;
   type Tls: Read + Write;

   fn connect_tcp(&mut self, host: &str, port: u16) -> io::Result<Self::Tcp>;
   fn connec_tls(&mut self, host: &str, port: u16) -> io::Result<Self::Tls>;
}

provide a default implementation using happy::connect and native_tls but expose a method like

pub struct PreparedRequest {
  pub fn send_with_streams(&mut self, streams: impl Streams) -> Result<Response> { ... }
}

This way we can remove the connect_timeout and read_timeout API as they can be replaced by this. Same goes for this certificate validation handling. It would even allow to use attohttpc with alternative TLS implementations like rustls and we can use this for testing to replace the BaseStream::Mock variant.

It would also allow third parties to avoid Happy Eyeballs if they do not want for whatever reason or to add request deadlines in any of the ways we discussed so far without making attohttpc itself much more complex. We would just need to provide documentation and example as guidance on how to do that using this trait.

[adamreichold]

#41 is another thing that could be resolved using the API.

[sbstp]

What I had in mind for this library was more of a turnkey experience, similar to Python's requests. I think there's a finite and reasonable set of features that people might expect to see in a library like this.

I'm not against offering lower level hooks that enable people to customize the library even more, but for now, I don't want to turn people away and tell them to just do it themselves.

For instance to disable tls verification in requests you just set the verify param to False.