Disabled TLS validation (ARCH3119)

Key typescript.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Unconditionally bypassing certificate or hostname validation defeats TLS authentication and opens the door to man-in-the-middle attacks. Always keep validation enabled.

Incorrect

import https from "https";

const agent = new https.Agent({ rejectUnauthorized: false });
const res = await fetch("https://api.example.com", { agent });

Correct

import https from "https";

const agent = new https.Agent({ rejectUnauthorized: true });
const res = await fetch("https://api.example.com", { agent });

Fix

Never set rejectUnauthorized: false; for private CAs, explicitly trust the certificate via the ca option.