fix(poh-signer-api): SSL connection to Web3Signer

[alainncls]

Note

Removes rejectUnauthorized from the HTTPS Agent options used to call Web3Signer.

• Backend
  • HTTPS Agent Configuration: Remove rejectUnauthorized from createWeb3SignerHttpsAgent in packages/poh-signer-api/src/modules/signer/signer.service.ts.

^{Written by Cursor Bugbot for commit d46e8a1. This will update automatically on new commits. Configure here.}

[cursor]

Bug: SSL Validation Bypass in HTTPS Agent

Removing rejectUnauthorized: true from the HTTPS Agent configuration disables SSL certificate validation. In Node.js, when rejectUnauthorized is not explicitly set, it defaults to false, allowing connections to servers with invalid, expired, or untrusted certificates. This creates a serious vulnerability to man-in-the-middle attacks when connecting to Web3Signer.

packages/poh-signer-api/src/modules/signer/signer.service.ts#L174-L180

linea-ens/packages/poh-signer-api/src/modules/signer/signer.service.ts

Lines 174 to 180 in d46e8a1

	return new Agent({
	pfx: clientPfx,
	passphrase: keystorePassphrase,
	ca: caCertPem,
	requestCert: true,
	});

 

---