Skip to content

Commit 6dc2014

Browse files
committed
fix: authorize servers mismatching certificate
This commit fixes an security issue where NodeLink would still keep if the server didn't match with the certificate, easing up MTM attacks.
1 parent 1f6ddc7 commit 6dc2014

File tree

2 files changed

+3
-4
lines changed

2 files changed

+3
-4
lines changed

config.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ export default {
88
"version": {
99
"major": "1",
1010
"minor": "15",
11-
"patch": "0",
11+
"patch": "1",
1212
"preRelease": null
1313
},
1414
"server": {

src/utils.js

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,7 @@ export function http1makeRequest(url, options) {
5050
'DNT': '1',
5151
...(options.headers || {}),
5252
...(options.body ? { 'Content-Type': 'application/json' } : {})
53-
},
54-
rejectUnauthorized: false
53+
}
5554
}, async (res) => {
5655
if (res.statusCode == 401) throw new Error(`[\u001b[31mhttp1makeRequest\u001b[37m]: Received 401 in url: ${url}.`)
5756

@@ -142,7 +141,7 @@ export function makeRequest(url, options) {
142141
const parsedUrl = new URL(url)
143142
let compression = null
144143

145-
const client = http2.connect(parsedUrl.origin, { rejectUnauthorized: false })
144+
const client = http2.connect(parsedUrl.origin,)
146145

147146
let reqOptions = {
148147
':method': options.method,

0 commit comments

Comments
 (0)