Fix SSL verification precedence: Respect session.verify when method verify parameter is None

[tboy1337]

Summary

Potentially solves #5922, #5816, #3829 and #5921 by fixing a bug in SSL verification handling where session.verify=False was not properly respected when the method-level verify parameter was None (not explicitly provided). The environment variables REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE would incorrectly override the session's verify setting.

Problem

The previous implementation had a logical flaw in Session.request() that checked if the method-level verify parameter was True or None before applying environment variables, but it did not consider the session's verify setting first. This meant:

• When session.verify=False and verify=None (default), the code would still check environment variables
• If environment variables like REQUESTS_CA_BUNDLE were set to invalid paths, the request would fail even though the user explicitly disabled verification at the session level
• This violated the expected precedence order: method parameter > session setting > environment variables

Solution

Modified the verification logic in sessions.py to:

1. First determine the effective verify setting by choosing method parameter if explicitly provided, otherwise fall back to session setting
2. Only then check if the effective setting is True or None before applying environment variables
3. This ensures session.verify=False is respected when no method-level override is provided

Code Changes

• src/requests/sessions.py: Updated the verify parameter resolution logic to properly respect precedence
• tests/test_requests.py: Added 9 comprehensive test cases covering all combinations of session and method verify parameters

Test Coverage

Added tests for all 9 combinations of session.verify and method verify parameters:

• session.verify=True with method verify=True/None/False
• session.verify=None with method verify=True/None/False
• session.verify=False with method verify=True/None/False (the bug case)

All tests validate that:

• Method-level parameters always override session settings when explicitly provided
• Session settings are respected when method parameter is None
• Environment variables are only consulted when the effective verify value is True or None

Impact

This fix ensures consistent and predictable SSL verification behavior, particularly for users who:

• Set session.verify=False for testing or development environments
• Have REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE environment variables configured
• Expect session-level settings to apply across multiple requests

Backward Compatibility

This change is backward compatible. It only fixes incorrect behavior where session settings were being ignored. All valid use cases continue to work as expected.