diff options
| author | Ben Noordhuis <info@bnoordhuis.nl> | 2012-08-30 15:14:37 +0200 |
|---|---|---|
| committer | Ben Noordhuis <info@bnoordhuis.nl> | 2012-09-15 00:19:06 +0200 |
| commit | 35607f3a2dda03af8cf2dd3704c0c915e28aa774 (patch) | |
| tree | 95a92b0aff7a248a9879054c29e4ba6a0acb8836 /doc/api/https.markdown | |
| parent | 4c171a504d2357185efab21e81b33e2dee1ab1da (diff) | |
| download | node-35607f3a2dda03af8cf2dd3704c0c915e28aa774.tar.gz | |
tls, https: validate server certificate by default
This commit changes the default value of the rejectUnauthorized option from
false to true.
What that means is that tls.connect(), https.get() and https.request() will
reject invalid server certificates from now on, including self-signed
certificates.
There is an escape hatch: if you set the NODE_TLS_REJECT_UNAUTHORIZED
environment variable to the literal string "0", node.js reverts to its
old behavior.
Fixes #3949.
Diffstat (limited to 'doc/api/https.markdown')
| -rw-r--r-- | doc/api/https.markdown | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/doc/api/https.markdown b/doc/api/https.markdown index e2c9862a0..943395a55 100644 --- a/doc/api/https.markdown +++ b/doc/api/https.markdown @@ -119,7 +119,7 @@ The following options from [tls.connect()][] can also be specified. However, a - `rejectUnauthorized`: If `true`, the server certificate is verified against the list of supplied CAs. An `'error'` event is emitted if verification fails. Verification happens at the connection level, *before* the HTTP - request is sent. Default `false`. + request is sent. Default `true`. In order to specify these options, use a custom `Agent`. |