search

braathen / qlik-auth-net

ASP.NET module for simplifying custom authentication with Qlik Sense.
MIT License
15 stars 15 forks source link

Insecure SSL Validation #4

Open Zyano opened 6 years ago

Zyano commented 6 years ago

Hello,

While this is a nice example and demonstrates who to do the authentication with Qlik I do believe that the following line: ServicePointManager.ServerCertificateValidationCallback = delegate { return true; }; Source

It is dangerous since it will affect all subsequent certificate validations, even for requests that are unrelated to the Qlik implementation.

braathen commented 6 years ago

I totally agree, it's a dumb way of doing it... If there's a desire to NOT validate the cert then it's probably a lot better to use HttpWebRequest.ServerCertificateValidationCallback on the specific request to not disturb others. Just need to find the time to look at this some day....