Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-014

Disabled TLS/SSL certificate verification

highJavaScript / TypeScriptCWE-295CVSS 7.4

What it detects

Disabling certificate verification makes the connection vulnerable to MITM attacks.

How to fix

Never disable certificate verification in production. Fix the certificate instead.

Vulnerable — Shield flags thisclient.js
const https = require("https");
const axios = require("axios");

// "Fix" for the self-signed cert on the internal API
const agent = new https.Agent({ rejectUnauthorized: false });

async function getHealth() {
  const res = await axios.get("https://internal-api.corp.local/health", {
    httpsAgent: agent,
  });
  return res.data;
}
Fixed — scans cleanclient.js
const fs = require("fs");
const https = require("https");
const axios = require("axios");

// Trust the internal CA instead of disabling verification
const agent = new https.Agent({ ca: fs.readFileSync("/etc/ssl/corp-root-ca.pem") });

async function getHealth() {
  const res = await axios.get("https://internal-api.corp.local/health", {
    httpsAgent: agent,
  });
  return res.data;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-014: Disabled TLS/SSL certificate verification — Zennoxa Shield