Nodejs/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-21 10:59:27 +00:00
Code Issues Actions 25 Packages Projects Releases Wiki Activity

tls: warn on NODE_TLS_REJECT_UNAUTHORIZED = '0'

Browse Source 
Warn on the first request that sets the
NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0'.

PR-URL: https://github.com/nodejs/node/pull/21900
Refs: https://github.com/nodejs/node/issues/21774
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit is contained in:
cjihrig 2018-07-19 22:02:44 -04:00
parent 87f767160d
commit 3095eecc47
No known key found for this signature in database
GPG Key ID: 7434390BDBE9B9C5
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/_tls_wrap.js
View File

@ -1098,14 +1098,25 @@ function onConnectEnd() {
}
}
let warnOnAllowUnauthorized = true;
// Arguments: [port,] [host,] [options,] [cb]
exports.connect = function connect(...args) {
args = normalizeConnectArgs(args);
var options = args[0];
var cb = args[1];
const allowUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
if (allowUnauthorized && warnOnAllowUnauthorized) {
warnOnAllowUnauthorized = false;
process.emitWarning('Setting the NODE_TLS_REJECT_UNAUTHORIZED ' +
'environment variable to \'0\' makes TLS connections ' +
'and HTTPS requests insecure by disabling ' +
'certificate verification.');
}
var defaults = {
rejectUnauthorized: '0' !== process.env.NODE_TLS_REJECT_UNAUTHORIZED,
rejectUnauthorized: !allowUnauthorized,
ciphers: tls.DEFAULT_CIPHERS,
checkServerIdentity: tls.checkServerIdentity,
minDHSize: 1024

8
test/parallel/test-https-strict.js
View File

@ -28,6 +28,14 @@ if (!common.hasCrypto)
// disable strict server certificate validation by the client
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
common.expectWarning(
'Warning',
'Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to \'0\' ' +
'makes TLS connections and HTTPS requests insecure by disabling ' +
'certificate verification.',
common.noWarnCode
);
const assert = require('assert');
const https = require('https');