delta/node-new.git/lib/https.js, branch pull-request-doc-updates

tls: introduce client 'session' event

2019-02-02T03:06:58+00:00

OpenSSL has supported async notification of sessions and tickets since
1.1.0 using SSL_CTX_sess_set_new_cb(), for all versions of TLS. Using
the async API is optional for TLS1.2 and below, but for TLS1.3 it will
be mandatory. Future-proof applications should start to use async
notification immediately. In the future, for TLS1.3, applications that
don't use the async API will silently, but gracefully, fail to resume
sessions and instead do a full handshake.

See: https://wiki.openssl.org/index.php/TLS1.3#Sessions

PR-URL: https://github.com/nodejs/node/pull/25831
Reviewed-By: Anna Henningsen 
Reviewed-By: Fedor Indutny

lib: support overriding http\s.globalAgent

2019-01-07T23:10:36+00:00

Overriding `require('http[s]').globalAgent` is now respected by
consequent requests.

In order to achieve that, the following changes were made:

1. Implmentation in `http`: `module.exports.globalAgent` is now defined
through `Object.defineProperty`. Its getter and setter return \ set
`require('_http_agent').globalAgent`.

2. Implementation in `https`: the https `globalAgent` is not the same
as `_http_agent`, and is defined in `https` module itself. Therefore,
the fix here was to simply use `module.exports.globalAgent` to support
mutation.

3. According tests were added for both `http` and `https`, where in
both we create a server, set the default agent to a newly created
instance and make a request to that server. We then assert that the
given instance was actually used by inspecting its sockets property.

Fixes: https://github.com/nodejs/node/issues/23281

PR-URL: https://github.com/nodejs/node/pull/25170
Reviewed-By: James M Snell

lib: remove internal `util._extends()` usage

2018-12-20T12:52:44+00:00

This removes all internal calls to the deprecated `_extends()`
function. It is slower than `Object.assign()` and the object spread
notation since V8 6.8 and using the spread notation often also
results in shorter code.

PR-URL: https://github.com/nodejs/node/pull/25105
Reviewed-By: Michaël Zasso 
Reviewed-By: James M Snell 
Reviewed-By: Anna Henningsen 
Reviewed-By: Luigi Pinca

lib: use ES6 class inheritance style

2018-12-05T15:55:00+00:00

PR-URL: https://github.com/nodejs/node/pull/24755
Reviewed-By: Joyee Cheung 
Reviewed-By: Luigi Pinca 
Reviewed-By: Matteo Collina

lib: remove `inherits()` usage

2018-12-05T15:53:58+00:00

This switches all `util.inherits()` calls to use
`Object.setPrototypeOf()` instead. In fact, `util.inherits()` is
mainly a small wrapper around exactly this function while adding
the `_super` property on the object as well.

Refs: #24395

PR-URL: https://github.com/nodejs/node/pull/24755
Refs: https://github.com/nodejs/node/issues/24395
Reviewed-By: Joyee Cheung 
Reviewed-By: Luigi Pinca 
Reviewed-By: Matteo Collina

http,https: protect against slow headers attack

2018-11-28T00:36:34+00:00

CVE-2018-12122

An attacker can send a char/s within headers and exahust the resources
(file descriptors) of a system even with a tight max header length
protection. This PR destroys a socket if it has not received the headers
in 40s.

PR-URL: https://github.com/nodejs-private/node-private/pull/144
Reviewed-By: Sam Roberts 
Reviewed-By: Ben Noordhuis 
Reviewed-By: James M Snell

tls: add min/max protocol version options

2018-11-22T17:14:58+00:00

The existing secureProtocol option only allows setting the allowed
protocol to a specific version, or setting it to "all supported
versions". It also used obscure strings based on OpenSSL C API
functions. Directly setting the min or max is easier to use and explain.

PR-URL: https://github.com/nodejs/node/pull/24405
Reviewed-By: Refael Ackermann 
Reviewed-By: Rod Vagg

https: allow url and options to be passed to https.request

2018-08-01T05:53:25+00:00

PR-URL: https://github.com/nodejs/node/pull/22003
Reviewed-By: Matteo Collina 
Reviewed-By: James M Snell

lib,src: remove openssl feature conditionals

2018-06-07T22:53:37+00:00

Remove compile-time and run-time conditionals for features that
OpenSSL 1.0.0 and 1.0.1 didn't support: ALPN, OCSP and/or SNI.
They are no longer necessary since our baseline is OpenSSL 1.0.2.

PR-URL: https://github.com/nodejs/node/pull/21094
Reviewed-By: Anna Henningsen 
Reviewed-By: Ruben Bridgewater 
Reviewed-By: James M Snell 
Reviewed-By: Tobias Nießen 
Reviewed-By: Trivikram Kamat 
Reviewed-By: Colin Ihrig

https: removed extra _http_server require

2018-06-06T01:57:39+00:00

PR-URL: https://github.com/nodejs/node/pull/21069
Reviewed-By: Ruben Bridgewater 
Reviewed-By: James M Snell 
Reviewed-By: Kyle Farnung 
Reviewed-By: Trivikram Kamat 
Reviewed-By: Rich Trott 
Reviewed-By: Daniel Bevenius 
Reviewed-By: Jon Moss 
Reviewed-By: Luigi Pinca