From 7e33d5f3635e749343cee56ae3f13eaa3de98e88 Mon Sep 17 00:00:00 2001 From: Raul Gomez Rodriguez Date: Wed, 24 Jun 2026 10:52:44 -0700 Subject: [PATCH] Enable SSL certificate verification for PlayFab API requests CURLOPT_SSL_VERIFYPEER was set to false, disabling TLS certificate verification for all PlayFab API requests and exposing the secret API key and traffic to man-in-the-middle attacks. Set it to true to match the upstream XPlatCppSdk fix. Resolves AB#62661974. --- cpp/cppsdk/source/playfab/PlayFabHttp.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/cppsdk/source/playfab/PlayFabHttp.cpp b/cpp/cppsdk/source/playfab/PlayFabHttp.cpp index 1f0d2813..5835a37c 100644 --- a/cpp/cppsdk/source/playfab/PlayFabHttp.cpp +++ b/cpp/cppsdk/source/playfab/PlayFabHttp.cpp @@ -189,7 +189,7 @@ namespace PlayFab curl_easy_setopt(reqContainer.curlHandle, CURLOPT_WRITEFUNCTION, CurlReceiveData); // Send - curl_easy_setopt(reqContainer.curlHandle, CURLOPT_SSL_VERIFYPEER, false); // TODO: Replace this with a ca-bundle ref??? + curl_easy_setopt(reqContainer.curlHandle, CURLOPT_SSL_VERIFYPEER, true); const auto res = curl_easy_perform(reqContainer.curlHandle); if (res != CURLE_OK) {