spdycat doesn't validate server certificates

tatsuhiro-t / spdylay

The experimental SPDY protocol version 2, 3 and 3.1 implementation in C

http://tatsuhiro-t.github.io/spdylay/

MIT License

602 stars 102 forks source link

spdycat doesn't validate server certificates #130

Open acdha opened 9 years ago

acdha commented 9 years ago

While testing a new webserver, I happened to run spdycat v1.3.2 against a server which has a valid SSL certificate but not for the hostname in question. Everything worked without any indication that it should not have.

tatsuhiro-t commented 9 years ago

spdycat is designed as debugging tool for SPDY protocol application, and no much work has been done for certificate verification so far.