Commit b03bd3a
doc: clarify tlsSocket.authorized on resumption
The peer certificate is not verified again when a connection resumes a
TLS session. When the original handshake included a client certificate,
authorized and authorizationError carry the verification result stored
with the session; on TLS 1.3, a client that sent no certificate can
resume a session and report authorized as true. Document this and point
manual-authorization servers at isSessionReused() and
getPeerCertificate().
Fixes: #35317
Signed-off-by: Julian Soreavis <julian.soreavis@gmail.com>
PR-URL: #64584
Reviewed-By: Tim Perry <pimterry@gmail.com>1 parent 7264efb commit b03bd3a
1 file changed
Lines changed: 13 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1072,6 +1072,18 @@ added: v0.11.4 | |||
| 1072 | 1072 | This property is `true` if the peer certificate was signed by one of the CAs | |
| 1073 | 1073 | specified when creating the `tls.TLSSocket` instance, otherwise `false`. | |
| 1074 | 1074 | ||
| 1075 | + The peer certificate is only verified during a full TLS handshake. When a | ||
| 1076 | + connection is established by resuming a previous session (see | ||
| 1077 | + [Session Resumption][]), verification is not repeated. If the client | ||
| 1078 | + presented a certificate in the original handshake, `authorized` and | ||
| 1079 | + `authorizationError` carry the result stored with the session, including | ||
| 1080 | + any verification error. On TLS 1.3, a client that sent no certificate at | ||
| 1081 | + all can resume a session and report `authorized` as `true`, while | ||
| 1082 | + [`tls.TLSSocket.getPeerCertificate()`][] returns an empty object. Servers | ||
| 1083 | + that authorize clients manually with `rejectUnauthorized: false` should | ||
| 1084 | + therefore also check [`tls.TLSSocket.isSessionReused()`][] and that a peer | ||
| 1085 | + certificate is present. | ||
| 1086 | + | ||
| 1075 | 1087 | ### `tlsSocket.disableRenegotiation()` | |
| 1076 | 1088 | ||
| 1077 | 1089 | <!-- YAML | |
@@ -2571,6 +2583,7 @@ added: v0.11.3 | |||
| 2571 | 2583 | [`tls.TLSSocket.getProtocol()`]: #tlssocketgetprotocol | |
| 2572 | 2584 | [`tls.TLSSocket.getSession()`]: #tlssocketgetsession | |
| 2573 | 2585 | [`tls.TLSSocket.getTLSTicket()`]: #tlssocketgettlsticket | |
| 2586 | + [`tls.TLSSocket.isSessionReused()`]: #tlssocketissessionreused | ||
| 2574 | 2587 | [`tls.TLSSocket.servername`]: #tlssocketservername | |
| 2575 | 2588 | [`tls.TLSSocket`]: #class-tlstlssocket | |
| 2576 | 2589 | [`tls.connect()`]: #tlsconnectoptions-callback | |
0 commit comments