RocketChat / RocketChat/Rocket.Chat
Allow invalid and Self-Signed SSL not effective for oauth
Open
Nobody has claimed this yet.
feat: oauth / sso
type: bug
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
I'm testing rocket.cat with gitlab oath. I've got a self signed cert on the gitlab server, and I'm unable to authenticate against it due to the self signed certificate.
{"line":"398","file":"oauth_server.js","message":"Error in OAuth Server: Failed to complete OAuth handshake with gitlab at https://example.com/oauth/token. DEPTH_ZERO_SELF_SIGNED_CERT","time":{"$date":1443438610410},"level":"warn"}
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at oauth_server.js around line 398 and trace the OAuth token handshake with GitLab, including how SSL certificate errors are handled. Confirm the expected behavior for self-signed certificates and invalid SSL settings, then verify that OAuth authentication succeeds without the DEPTH_ZERO_SELF_SIGNED_CERT failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100