1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tls: warn on NODE_TLS_REJECT_UNAUTHORIZED = '0'

Browse Source 
Warn on the first request that sets the
NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0'.

PR-URL: https://github.com/nodejs/node/pull/21900
Refs: https://github.com/nodejs/node/issues/21774
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit is contained in:
cjihrig 2018-07-19 22:02:44 -04:00
parent 87f767160d
commit 3095eecc47
No known key found for this signature in database
GPG Key ID: 7434390BDBE9B9C5
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/_tls_wrap.js
View File

@ -1098,14 +1098,25 @@ function onConnectEnd() {
} }
} }
let warnOnAllowUnauthorized = true;
// Arguments: [port,] [host,] [options,] [cb] // Arguments: [port,] [host,] [options,] [cb]
exports.connect = function connect(...args) { exports.connect = function connect(...args) {
args = normalizeConnectArgs(args); args = normalizeConnectArgs(args);
var options = args[0]; var options = args[0];
var cb = args[1]; var cb = args[1];
const allowUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
if (allowUnauthorized && warnOnAllowUnauthorized) {
warnOnAllowUnauthorized = false;
process.emitWarning('Setting the NODE_TLS_REJECT_UNAUTHORIZED ' +
'environment variable to \'0\' makes TLS connections ' +
'and HTTPS requests insecure by disabling ' +
'certificate verification.');
}
var defaults = { var defaults = {
rejectUnauthorized: '0' !== process.env.NODE_TLS_REJECT_UNAUTHORIZED, rejectUnauthorized: !allowUnauthorized,
ciphers: tls.DEFAULT_CIPHERS, ciphers: tls.DEFAULT_CIPHERS,
checkServerIdentity: tls.checkServerIdentity, checkServerIdentity: tls.checkServerIdentity,
minDHSize: 1024 minDHSize: 1024

8
test/parallel/test-https-strict.js
View File

@ -28,6 +28,14 @@ if (!common.hasCrypto)
// disable strict server certificate validation by the client // disable strict server certificate validation by the client
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
common.expectWarning(
'Warning',
'Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to \'0\' ' +
'makes TLS connections and HTTPS requests insecure by disabling ' +
'certificate verification.',
common.noWarnCode
);
const assert = require('assert'); const assert = require('assert');
const https = require('https'); const https = require('https');