search

nos / client

The nOS Client
https://nos.io
MIT License
199 stars 73 forks source link

Security Risk: Disabling certificate validation in HTTPS agent #1485

Open tianjk99 opened 8 months ago

tianjk99 commented 8 months ago

A security issue was found in your project. I hope you will check whether this approach poses security risks.

  1. src/common/util/getRPCEndpoint.js, line 6. The current implementation in getRPCEndpoint.js disables certificate validation by setting the rejectUnauthorized option of the https.Agent to false. This introduces a potential security risk.

It is recommended to enable certificate validation by setting rejectUnauthorized to true in the https.Agent configuration. This ensures secure and authenticated HTTPS connections.