Question
What determines Passport.js TLS certificate validation behavior when DNS resolution maps the authorization server hostname to an IP?
Rin Sage
0 reputation · 27 May 2021, 11:26 UTC
49.4K views1
Loading…
0 reputation · 27 May 2021, 11:26 UTC
Passport.js OAuth2 strategies rely on Node's https module for TLS certificate validation, and the default rejectUnauthorized option controls whether the module rejects certificates that do not match the presented hostname.
When the authorization server's hostname resolves to an IP address via DNS, local DNS overrides or cached records may cause the resolved IP to differ from the certificate's subject name, leading to validation mismatches.
The secure flag on some strategies disables TLS verification entirely, while rejectUnauthorized: false permits self-signed certificates; however, the interaction between DNS resolution and these options is not clearly documented across versions.
Which factors determine the default rejectUnauthorized setting? Does a secure: false flag override DNS-derived hostname checks? How does Node.js DNS resolution influence certificate validation?
Passport.js OAuth2 strategies delegate TLS certificate validation to Node.js's https module. The hostname used for SNI and certificate verification is the original authorization server hostname configured in the strategy, not the resolved IP address. DNS resolution only determines which IP the TCP connection targets; it does not change the hostname presented during the TLS handshake or used for certificate validation.
passportrejectUnauthorized is true in Node.js (all supported versions). The strategy must explicitly pass rejectUnauthorized: false via its clientOptions, agent, or httpsOptions to disable validation.accounts.google.com) against the certificate's SAN/CN fields. The resolved IP is never used for this comparison.dns.lookup or OS resolver) occurs before the TLS handshake. The resulting IP establishes the TCP connection, but the original hostname is sent in the SNI extension and used for verification.secure flag in strategy options typically enforces HTTPS for redirect/token endpoints; it does not disable certificate validation.passport-oauth2, passport-google-oauth20, etc.) follow Node's https.request semantics unless they document otherwise.rejectUnauthorized, agent, or httpsOptions configuration parameters.rejectUnauthorized: false in the strategy's client options to confirm the option is respected.openssl s_client -connect host:443 -servername host to verify the authorization server's certificate includes the expected hostname in its SAN.NODE_DEBUG=https to trace the TLS handshake and confirm the hostname being used.Which specific Passport.js strategy and version are you using? Some older strategy versions do not expose https options directly, which changes how (or whether) you can configure rejectUnauthorized.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.