Hey folks,
So I just noticed that the node built in fetch dont reject unauthorized certs by default? Like, it just happily connects to servers with self-signed or invalid certs.
Isn’t that kinda risky? Or am I missing something?
I get that it might be for dev convenience, but how do I *enforce* strict cert checks? I don’t wanna accidentally ignore security issues in prod.
Also, is there a way to *disable* this behavior if I *do* wanna reject unauthorized certs? Tried googling but couldn’t find a straight answer.
Thanks in advance!
(Also, why isn’t this more clearly documented? Feels like a gotcha waiting to happen.)
Yeah, the node built in fetch dont reject unauthorized certs by default, which is wild.
For enforcing strict checks, you can use the `https` agent with `rejectUnauthorized: true`. Here's a quick snippet:
```javascript
import https from 'https';
const agent = new https.Agent({ rejectUnauthorized: true });
fetch('https://yoursite.com', { agent });
```
If you're using something like Axios, it’s similar—just pass the agent in the config.
Also, check out the `node-fetch` docs if you’re using an older version. They’ve got some quirks too.
Wait, really? I had no idea node built in fetch dont reject unauthorized certs. That’s... not great.
For prod, you *definitely* wanna override this. The `rejectUnauthorized` flag is your friend.
If you’re lazy (like me), you could also use a library like `got`—it’s stricter by default and way better documented.
Kinda surprised this isn’t more obvious in the Node docs. Feels like a security footgun.
Oh man, this tripped me up too. The node built in fetch dont reject unauthorized certs because, well, Node loves to give you enough rope to hang yourself.
For strict checks, you gotta pass an `https.Agent` with `rejectUnauthorized: true`.
If you’re debugging, tools like `mitmproxy` or `charles` can help inspect certs to make sure you’re not silently failing.
Also, +1 to the docs being vague. Classic Node.
Yep, node built in fetch dont reject unauthorized certs by default. It’s a trade-off for dev flexibility, but yeah, risky in prod.
To enforce checks:
```javascript
const https = require('https');
const fetch = require('node-fetch');
const agent = new https.Agent({ rejectUnauthorized: true });
await fetch('https://example.com', { agent });
```
If you’re using native fetch in newer Node, same idea—just pass the agent.
Kinda annoying this isn’t the default, tbh.
This is why I always use `axios` with a custom `httpsAgent`. The node built in fetch dont reject unauthorized certs, which is fine for localhost but scary otherwise.
Here’s how I do it:
```javascript
const https = require('https');
const axios = require('axios');
const agent = new https.Agent({ rejectUnauthorized: true });
axios.get('https://example.com', { httpsAgent: agent });
```
Way safer, and Axios gives you better error handling too.
lol yeah, node built in fetch dont reject unauthorized certs because Node assumes you know what you’re doing. (Spoiler: we don’t.)
For strict mode, you need to manually set `rejectUnauthorized: true` in an `https.Agent`.
If you’re paranoid (like me), run a test with a bad cert to make sure it actually fails.
Docs? Ha. Good luck.
Fun fact: the node built in fetch dont reject unauthorized certs because back in the day, everyone used self-signed certs for testing. Now it’s just legacy baggage.
To fix it, you gotta use an `https.Agent` like everyone’s saying.
If you’re using TypeScript, definitely add a note to your codebase—this is the kind of thing that’ll bite you later.
Ugh, this is why I switched to `undici` for fetch stuff. The node built in fetch dont reject unauthorized certs, and it’s way too easy to miss.
If you’re stuck with native fetch, here’s the workaround:
```javascript
const agent = new https.Agent({ rejectUnauthorized: true });
await fetch(url, { agent });
```
Also, `ssl-checker` (npm package) can help verify certs if you’re unsure.
Thanks everyone! Super helpful. I tried the `https.Agent` trick and it works—finally failing on bad certs like it should.
Still weird that the node built in fetch dont reject unauthorized certs by default, but at least there’s a fix.
Follow-up: Anyone know if this is the same in Deno? Or do they handle it better?
Also, shoutout to the `got` and `axios` suggestions—might switch to one of those for less headache.
