如何为任何请求禁用 SSL 验证？

Question

I have a Node.JS service running, which I am trying to connect from a different system. Currently using POSTMAN to test the service. Postman gives an error - There was an error connecting to https://lddbbtx.wdf......./index.xsjs. Now, I retried the request by disabling 'SSL certification verification' option in Postman and it seems to work. I can receive the response from the service.

But in production, we will be using Recast.AI to connect to this service. In Recast, they provide a means to set Headers for the GET/POST requests . SO , I wanted to know, is there a way to disable the SSL verification in the header of the request ?

Answer 1

... is there a way to disable the SSL verification in the header of the request ?

Validation of the server certificate is done at the client side. It is done during the TLS handshake and thus before any HTTP request is send. Disabling validation cannot be triggered by the server since otherwise a man in the middle attacker could simply instruct the victim to not check the certificate.

In general - disabling validation or even part of the validation (like checking that hostname in URL matches certificate) is a very bad idea. With disabled certificate validation the transport is still encrypted but the client does not check that it actually communicates with the expected server. This way an attacker could do a simple man in the middle attack to impersonate the server and thus sniff and also modify all traffic.