Driver does not verify server identity by default

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 4.0.0
    • Affects Version/s: 4.0.0
    • Component/s: Shell
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      When connecting to a server using TLS, the Node Driver does not verify the identity of the server by default.

      This is caused by the code in the following location: https://github.com/mongodb/node-mongodb-native/blob/ee1a4d32ac95b7d143b08896bc486cfa8c2895a1/src/cmap/connect.ts#L250-L257

      This poses a potential security risk. A user can still skip the check by passing --tlsAllowInvalidCertificates or --tlsAllowInvalidHostnames.

      As matt.broadstone mentioned in Slack, it might be a cause for AWS test failures in CI - I'll just add that in here to maybe investigate, too!

              Assignee:
              Neal Beeken
              Reporter:
              Michael Rose (Inactive)
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: