diff options
| author | Tobias Nießen <tniessen@tnie.de> | 2022-01-17 17:35:47 +0300 |
|---|---|---|
| committer | Tobias Nießen <tniessen@tnie.de> | 2022-01-19 18:05:32 +0300 |
| commit | da1b59fc1388f8bffab870d80efa96db49439b6e (patch) | |
| tree | 409222019979fd5de213d7f55c3418fed56141bb /lib | |
| parent | 119519e1da2be1f180e8d66bd0bb79403624ea73 (diff) | |
crypto: support RFC 2818 compatible checkHost
The 'subject' option should not only accept the values 'always' and
'never' because neither is compatible with RFC 2818, i.e., HTTPS. This
change adds a third value 'default', which implies the behavior that
HTTPS mandates.
The new 'default' case matches the default behavior of OpenSSL for both
DNS names and email addresses.
Future Node.js versions should change the default option value from
'always' to 'default'.
Refs: https://github.com/nodejs/node/pull/36804
PR-URL: https://github.com/nodejs/node/pull/41569
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/internal/crypto/x509.js | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/internal/crypto/x509.js b/lib/internal/crypto/x509.js index 51b0d51b0de..603e3f8fc58 100644 --- a/lib/internal/crypto/x509.js +++ b/lib/internal/crypto/x509.js @@ -65,7 +65,8 @@ function isX509Certificate(value) { function getFlags(options = {}) { validateObject(options, 'options'); const { - subject = 'always', // Can be 'always' or 'never' + // TODO(tniessen): change the default to 'default' + subject = 'always', // Can be 'default', 'always', or 'never' wildcards = true, partialWildcards = true, multiLabelWildcards = false, @@ -78,6 +79,7 @@ function getFlags(options = {}) { validateBoolean(multiLabelWildcards, 'options.multiLabelWildcards'); validateBoolean(singleLabelSubdomains, 'options.singleLabelSubdomains'); switch (subject) { + case 'default': /* Matches OpenSSL's default, no flags. */ break; case 'always': flags |= X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT; break; case 'never': flags |= X509_CHECK_FLAG_NEVER_CHECK_SUBJECT; break; default: |