fix: replace module-level SSLContext with verify=True to prevent event loop blocking

[diegolameira]

Problem

The default session_factory in AuthCaptureProxy.__init__ uses:

ssl_context = create_default_context()  # module level
...
lambda: httpx.AsyncClient(verify=ssl_context)

When this factory is called inside an async event loop (e.g., from reset_data() during a Home Assistant config flow), httpx internally calls ssl.SSLContext.load_verify_locations(), which is a blocking I/O operation.

On Python 3.13+ and Home Assistant 2024.10+, this triggers:

Detected blocking call to load_verify_locations with args (<ssl.SSLContext ...>)
inside the event loop by custom integration 'alexa_media'

In some configurations (especially with HA 2026.4+ / Python 3.14), this blocking call can cause HA Core to crash with exit code 100 and enter a restart loop, making the entire instance unreachable.

Fix

Replace verify=ssl_context with verify=True. This lets httpx handle SSL verification through its own default certifi CA bundle — same security level, no blocking call.

The module-level create_default_context() and its import are also removed since they're no longer needed (the SSLContext import is retained for start_proxy()).

Related Issues

• Detected blocking call to load_verify_locations with args (<ssl.SSLContext object at 0x7fa53a8b13b0> alexa_media_player#3380
• WARNING: Detected blocking call to load_verify_locations with args (<ssl.SSLContext object at 0x7f155d069e50>,) inside the event loop by custom integration 'alexa_media alexa_media_player#2504
• Detected blocking call to load_verify_locations with args alexa_media_player#2503
• Detected blocking call to load_verify_locations with args alexa_media_player#2625
• Possible Solution for HTTP2 blocking operation alexa_media_player#2519

Testing

• Verified on Home Assistant 2026.4.1 (Python 3.14) with alexa_media_player 5.15.0
• Before fix: HA enters crash/restart loop with exit code 100, load_verify_locations blocking warnings
• After fix: HA boots cleanly, alexa_media loads without blocking warnings

Summary by CodeRabbit

• Refactor
  • Simplified internal SSL verification configuration for the auth proxy, streamlining how secure connections are established without affecting end-user functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9ff2faab-e3de-413b-92d6-3f4e00bf7693

📥 Commits

Reviewing files that changed from the base of the PR and between 67005c7 and 4d4888b.

📒 Files selected for processing (1)

• authcaptureproxy/auth_capture_proxy.py

---

Walkthrough

The module-level SSL context preconfiguration has been removed from the auth capture proxy. The HTTP client session factory now relies on the default SSL verification behavior (verify=True) instead of using a custom preconfigured SSL context, and the corresponding import has been cleaned up.

Changes

Cohort / File(s)	Summary
SSL Context Removal authcaptureproxy/auth_capture_proxy.py	Removed module-level ssl_context creation via create_default_context() and updated session factory to use default SSL verification (verify=True) instead of passing a preconfigured context. Removed unused import.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

SSL contexts melted away,
Default verification saves the day,
Three lines gone, simplicity gained,
The code now clean, no context strained. 🔐✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title clearly and specifically summarizes the main change: replacing a module-level SSLContext with verify=True to fix event loop blocking.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[danielbrunt57]

@diegolameira Please address the pull request test failure!