Disabled TLS Validation (ARCH5119)

Key go.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Setting InsecureSkipVerify: true turns off certificate and hostname validation entirely. This defeats TLS authentication and opens the door to man-in-the-middle (MITM) attacks.

Incorrect

tr := &http.Transport{
    TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}
client := &http.Client{Transport: tr}

Correct

tr := &http.Transport{
    TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12},
}
client := &http.Client{Transport: tr}

Fix

Remove InsecureSkipVerify; if needed, add custom certificates to a trusted RootCAs pool.