Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 348cc80

Browse filesBrowse files
ghaiklorsam-github
ghaiklor
authored and
sam-github
committed
tls: make rejectUnauthorized default to true
rejectUnauthorized used to be false when the property was undefined or null, quietly allowing client connections for which certificates have been requested (requestCert is true) even when the client certificate was not authorized (signed by a trusted CA). Change this so rejectUnauthorized is always true unless it is explicitly set to false. PR-URL: #5923 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
1 parent ee19e29 commit 348cc80
Copy full SHA for 348cc80

File tree

Expand file treeCollapse file tree

4 files changed

+16
-21
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

4 files changed

+16
-21
lines changed
Open diff view settings
Collapse file

‎doc/api/tls.md‎

Copy file name to clipboardExpand all lines: doc/api/tls.md
+9-7Lines changed: 9 additions & 7 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -712,7 +712,10 @@ added: v0.11.8
712712
-->
713713

714714
* `options` {Object}
715-
* `rejectUnauthorized` {boolean}
715+
* `rejectUnauthorized` {boolean} If not `false`, the server certificate is verified
716+
against the list of supplied CAs. An `'error'` event is emitted if
717+
verification fails; `err.code` contains the OpenSSL error code. Defaults to
718+
`true`.
716719
* `requestCert`
717720
* `callback` {Function} A function that will be called when the renegotiation
718721
request has been completed.
@@ -769,7 +772,7 @@ changes:
769772
connection/disconnection/destruction of `socket` is the user's
770773
responsibility, calling `tls.connect()` will not cause `net.connect()` to be
771774
called.
772-
* `rejectUnauthorized` {boolean} If `true`, the server certificate is verified
775+
* `rejectUnauthorized` {boolean} If not `false`, the server certificate is verified
773776
against the list of supplied CAs. An `'error'` event is emitted if
774777
verification fails; `err.code` contains the OpenSSL error code. Defaults to
775778
`true`.
@@ -1012,9 +1015,9 @@ changes:
10121015
* `requestCert` {boolean} If `true` the server will request a certificate from
10131016
clients that connect and attempt to verify that certificate. Defaults to
10141017
`false`.
1015-
* `rejectUnauthorized` {boolean} If `true` the server will reject any
1018+
* `rejectUnauthorized` {boolean} If not `false` the server will reject any
10161019
connection which is not authorized with the list of supplied CAs. This
1017-
option only has an effect if `requestCert` is `true`. Defaults to `false`.
1020+
option only has an effect if `requestCert` is `true`. Defaults to `true`.
10181021
* `NPNProtocols` {string[]|Buffer} An array of strings or a `Buffer` naming
10191022
possible NPN protocols. (Protocols should be ordered by their priority.)
10201023
* `ALPNProtocols` {string[]|Buffer} An array of strings or a `Buffer` naming
@@ -1190,9 +1193,8 @@ changes:
11901193
opened as a server.
11911194
* `requestCert` {boolean} `true` to specify whether a server should request a
11921195
certificate from a connecting client. Only applies when `isServer` is `true`.
1193-
* `rejectUnauthorized` {boolean} `true` to specify whether a server should
1194-
automatically reject clients with invalid certificates. Only applies when
1195-
`isServer` is `true`.
1196+
* `rejectUnauthorized` {boolean} If not `false` a server automatically reject clients
1197+
with invalid certificates. Only applies when `isServer` is `true`.
11961198
* `options`
11971199
* `secureContext`: An optional TLS context object from
11981200
[`tls.createSecureContext()`][]
Collapse file

‎lib/_tls_wrap.js‎

Copy file name to clipboardExpand all lines: lib/_tls_wrap.js
+3-12Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -920,17 +920,8 @@ Server.prototype.setTicketKeys = function setTicketKeys(keys) {
920920

921921

922922
Server.prototype.setOptions = function(options) {
923-
if (typeof options.requestCert === 'boolean') {
924-
this.requestCert = options.requestCert;
925-
} else {
926-
this.requestCert = false;
927-
}
928-
929-
if (typeof options.rejectUnauthorized === 'boolean') {
930-
this.rejectUnauthorized = options.rejectUnauthorized;
931-
} else {
932-
this.rejectUnauthorized = false;
933-
}
923+
this.requestCert = options.requestCert === true;
924+
this.rejectUnauthorized = options.rejectUnauthorized !== false;
934925

935926
if (options.pfx) this.pfx = options.pfx;
936927
if (options.key) this.key = options.key;
@@ -1062,7 +1053,7 @@ exports.connect = function(...args /* [port,] [host,] [options,] [cb] */) {
10621053
secureContext: context,
10631054
isServer: false,
10641055
requestCert: true,
1065-
rejectUnauthorized: options.rejectUnauthorized,
1056+
rejectUnauthorized: options.rejectUnauthorized !== false,
10661057
session: options.session,
10671058
NPNProtocols: NPN.NPNProtocols,
10681059
ALPNProtocols: ALPN.ALPNProtocols,
Collapse file

‎test/parallel/test-https-foafssl.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-https-foafssl.js
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ const https = require('https');
4242
const options = {
4343
key: fs.readFileSync(common.fixturesDir + '/agent.key'),
4444
cert: fs.readFileSync(common.fixturesDir + '/agent.crt'),
45-
requestCert: true
45+
requestCert: true,
46+
rejectUnauthorized: false
4647
};
4748

4849
const modulus = 'A6F44A9C25791431214F5C87AF9E040177A8BB89AC803F7E09BBC3A5519F' +
Collapse file

‎test/parallel/test-tls-session-cache.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-tls-session-cache.js
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@ function doTest(testOptions, callback) {
5656
key: key,
5757
cert: cert,
5858
ca: [cert],
59-
requestCert: true
59+
requestCert: true,
60+
rejectUnauthorized: false
6061
};
6162
let requestCount = 0;
6263
let resumeCount = 0;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.