FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tls: make rejectUnauthorized default to true · nodejs/node@348cc80 · GitHub

/ node Public

Commit 348cc80

Browse files
ghaiklor
authored and
sam-github
committed
tls: make rejectUnauthorized default to true
rejectUnauthorized used to be false when the property was undefined or null, quietly allowing client connections for which certificates have been requested (requestCert is true) even when the client certificate was not authorized (signed by a trusted CA). Change this so rejectUnauthorized is always true unless it is explicitly set to false. PR-URL: #5923 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
1 parent ee19e29 commit 348cc80

4 files changed

Lines changed: 16 additions & 21 deletions

File tree

‎doc/api/tls.md‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -712,7 +712,10 @@ added: v0.11.8
712712
-->
713713

714714
* `options` {Object}
715-
* `rejectUnauthorized` {boolean}
715+
* `rejectUnauthorized` {boolean} If not `false`, the server certificate is verified
716+
against the list of supplied CAs. An `'error'` event is emitted if
717+
verification fails; `err.code` contains the OpenSSL error code. Defaults to
718+
`true`.
716719
* `requestCert`
717720
* `callback` {Function} A function that will be called when the renegotiation
718721
request has been completed.
@@ -769,7 +772,7 @@ changes:
769772
connection/disconnection/destruction of `socket` is the user's
770773
responsibility, calling `tls.connect()` will not cause `net.connect()` to be
771774
called.
772-
* `rejectUnauthorized` {boolean} If `true`, the server certificate is verified
775+
* `rejectUnauthorized` {boolean} If not `false`, the server certificate is verified
773776
against the list of supplied CAs. An `'error'` event is emitted if
774777
verification fails; `err.code` contains the OpenSSL error code. Defaults to
775778
`true`.
@@ -1012,9 +1015,9 @@ changes:
10121015
* `requestCert` {boolean} If `true` the server will request a certificate from
10131016
clients that connect and attempt to verify that certificate. Defaults to
10141017
`false`.
1015-
* `rejectUnauthorized` {boolean} If `true` the server will reject any
1018+
* `rejectUnauthorized` {boolean} If not `false` the server will reject any
10161019
connection which is not authorized with the list of supplied CAs. This
1017-
option only has an effect if `requestCert` is `true`. Defaults to `false`.
1020+
option only has an effect if `requestCert` is `true`. Defaults to `true`.
10181021
* `NPNProtocols` {string[]|Buffer} An array of strings or a `Buffer` naming
10191022
possible NPN protocols. (Protocols should be ordered by their priority.)
10201023
* `ALPNProtocols` {string[]|Buffer} An array of strings or a `Buffer` naming
@@ -1190,9 +1193,8 @@ changes:
11901193
opened as a server.
11911194
* `requestCert` {boolean} `true` to specify whether a server should request a
11921195
certificate from a connecting client. Only applies when `isServer` is `true`.
1193-
* `rejectUnauthorized` {boolean} `true` to specify whether a server should
1194-
automatically reject clients with invalid certificates. Only applies when
1195-
`isServer` is `true`.
1196+
* `rejectUnauthorized` {boolean} If not `false` a server automatically reject clients
1197+
with invalid certificates. Only applies when `isServer` is `true`.
11961198
* `options`
11971199
* `secureContext`: An optional TLS context object from
11981200
[`tls.createSecureContext()`][]

‎lib/_tls_wrap.js‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -920,17 +920,8 @@ Server.prototype.setTicketKeys = function setTicketKeys(keys) {
920920

921921

922922
Server.prototype.setOptions = function(options) {
923-
if (typeof options.requestCert === 'boolean') {
924-
this.requestCert = options.requestCert;
925-
} else {
926-
this.requestCert = false;
927-
}
928-
929-
if (typeof options.rejectUnauthorized === 'boolean') {
930-
this.rejectUnauthorized = options.rejectUnauthorized;
931-
} else {
932-
this.rejectUnauthorized = false;
933-
}
923+
this.requestCert = options.requestCert === true;
924+
this.rejectUnauthorized = options.rejectUnauthorized !== false;
934925

935926
if (options.pfx) this.pfx = options.pfx;
936927
if (options.key) this.key = options.key;
@@ -1062,7 +1053,7 @@ exports.connect = function(...args /* [port,] [host,] [options,] [cb] */) {
10621053
secureContext: context,
10631054
isServer: false,
10641055
requestCert: true,
1065-
rejectUnauthorized: options.rejectUnauthorized,
1056+
rejectUnauthorized: options.rejectUnauthorized !== false,
10661057
session: options.session,
10671058
NPNProtocols: NPN.NPNProtocols,
10681059
ALPNProtocols: ALPN.ALPNProtocols,

‎test/parallel/test-https-foafssl.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ const https = require('https');
4242
const options = {
4343
key: fs.readFileSync(common.fixturesDir + '/agent.key'),
4444
cert: fs.readFileSync(common.fixturesDir + '/agent.crt'),
45-
requestCert: true
45+
requestCert: true,
46+
rejectUnauthorized: false
4647
};
4748

4849
const modulus = 'A6F44A9C25791431214F5C87AF9E040177A8BB89AC803F7E09BBC3A5519F' +

‎test/parallel/test-tls-session-cache.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@ function doTest(testOptions, callback) {
5656
key: key,
5757
cert: cert,
5858
ca: [cert],
59-
requestCert: true
59+
requestCert: true,
60+
rejectUnauthorized: false
6061
};
6162
let requestCount = 0;
6263
let resumeCount = 0;

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL