Fix TLS certificate validation in Node.js and Express
=====================================================

Never turn verification off. Give the partner client an https.Agent whose ca
is the partner's private CA bundle, set rejectUnauthorized: true explicitly so
NODE_TLS_REJECT_UNAUTHORIZED=0 cannot flip it, and keep the default
checkServerIdentity. Node then checks the chain, the dates and the host name,
and any other certificate fails the handshake before the token is sent.

Page: https://softwaresecurity.com/fix/tls-certificate-validation/node-express/

What is in this archive
-----------------------
tls-certificate-validation/node-express/   the project: three implementations of the same code and one test suite
  impl/vulnerable.js   (vulnerable)
  impl/fixed.js   (fixed)
  impl/wrong.js   (a plausible fix that still fails)
run-all.mjs   runs the tests in all three modes and checks the results (Node.js only)
LICENSE-CODE.txt

Run it
------
  Tested with Node.js 26.11.1; package.json allows Node.js ^22.23.2 || ^24.18.1
  || >=26.5.1. run-all.mjs needs Node.js 22 or later. Supported versions:
  https://softwaresecurity.com/fix/versions/

  From the tls-certificate-validation/node-express folder, install the
  dependencies once (this needs network access):

    npm ci

  Then run the tests. IMPL chooses the implementation the tests load:

    # every test passes
    IMPL=fixed npm test --silent
    # an exploit test fails
    IMPL=vulnerable npm test --silent
    # a test fails
    IMPL=wrong npm test --silent

  The JUnit report is written to reports/junit.xml. To run all three modes and
  check the results in one step, run the harness from this top folder (it needs
  only Node.js; --install runs the install step first):

    node run-all.mjs --install tls-certificate-validation/node-express
    node run-all.mjs tls-certificate-validation/node-express

Verified
--------
  11 October 2026 on macOS 27.0 (Darwin 27.0.0, arm64), with node 26.11.1, npm
  11.20.0, express 5.3.0. Versions and results hold for that date: run the tests
  with your own versions before relying on the fix.

Licence
-------
  The code is MIT licensed (LICENSE-CODE.txt). The page text is CC BY 4.0.
