René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Reloading page bypasses TLS client authentication","articleBody":"\u003c!--\r\nThank you for reporting an issue.\r\n\r\nThis issue tracker is for bugs and issues found within Node.js core.\r\nIf you require more general support please file an issue on our help\r\nrepo. https://github.com/nodejs/help\r\n\r\n\r\nPlease fill in as much of the template below as you're able.\r\n\r\nVersion: output of `node -v`\r\nPlatform: output of `uname -a` (UNIX), or version and 32 or 64-bit (Windows)\r\nSubsystem: if known, please specify affected core module name\r\n--\u003e\r\n\r\n* **Version**: v12.18.3\r\n* **Platform**: Linux 5.8.8-100.fc31.x86_64 #1 SMP Wed Sep 9 20:29:23 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux\r\n* **Subsystem**: \r\n\r\n### What steps will reproduce the bug?\r\n- Obtain (or create) a CA certificate, a server certificate, and a server key supplied by said CA.\r\n- Compile (with typescript) and run the following code:\r\n```\r\nimport fs from 'fs';\r\nimport path from 'path';\r\nimport https from 'https';\r\nimport tls from 'tls';\r\nimport express from 'express';\r\n\r\n/* Alias environment variables */\r\nconst port = process.env.PORT || 443;\r\n\r\nconst httpsOptions = {\r\n    key: fs.readFileSync(path.join('certs', 'server.key')),\r\n    cert: fs.readFileSync(path.join('certs', 'server.crt')),\r\n    ca: fs.readFileSync(path.join('certs', 'ca.crt')),\r\n    requestCert: true,\r\n    rejectUnauthorized: false /* This is necessary to accept self-signed certificates, we will perform the authentication ourselves */\r\n};\r\n\r\n/* Create Express app */\r\nconst expressApp = express();\r\nconst expressServer = https.createServer(httpsOptions, expressApp);\r\n\r\nexpressApp.use((req,res,next) =\u003e {\r\n    console.log((req.socket as tls.TLSSocket).authorized ? 'true' : 'false');\r\n    if (!(req.socket as tls.TLSSocket).authorized) {\r\n        return res.status(401).send('Unauthorized');\r\n    }\r\n    next();\r\n});\r\n\r\nexpressServer.listen(port, () =\u003e {\r\n    console.log(`Server listening on port ${port}`);\r\n});\r\n```\r\n- Open Firefox (version 80) and go to https://localhost. You should have your connection rejected (output is 'false').\r\n- Reload the page. Your connection is now accepted (output is 'true').\r\n- This curiously doesn't happen on Chromium.\r\n\r\n\u003c!--\r\nEnter details about your bug, preferably a simple code snippet that can be\r\nrun using `node` directly without installing third-party dependencies.\r\n--\u003e\r\n\r\n### How often does it reproduce? Is there a required condition?\r\n- Always reproducible. Chromium seems to not trigger the issue.\r\n\r\n### What is the expected behavior?\r\n- Connection should always be rejected\r\n\r\n\u003c!--\r\nIf possible please provide textual output instead of screenshots.\r\n--\u003e\r\n\r\n### What do you see instead?\r\n- Connection is accepted after page reload\r\n\r\n\u003c!--\r\nIf possible please provide textual output instead of screenshots.\r\n--\u003e\r\n\r\n### Additional information\r\n- According to documentation at https://nodejs.org/api/tls.html#tls_tlssocket_authorized the `(req.socket as tls.TLSSocket).authorized` flag should always be false if the client certificate doesn't match the server CA. In this case it becomes true after a page reload from Firefox for unknown reasons.\r\n- This issue is described also in a stack overflow entry: https://stackoverflow.com/questions/60367338/result-of-req-socket-authorized-is-not-correct-using-nodejs-https-and-express\r\n- I'm guessing it might be due to some TLS connection reuse logic.\r\n\r\n\u003c!--\r\nTell us anything else you think we should know.\r\n--\u003e\r\n","author":{"url":"https://github.com/maikeriva","@type":"Person","name":"maikeriva"},"datePublished":"2020-09-23T15:05:29.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":13},"url":"https://github.com/35317/node/issues/35317"}