DBMigrate: allow unauthorized connections to DB #96
Conversation
There was a problem hiding this comment.
Pull request overview
This PR modifies the database migration SSL configuration to support unauthorized SSL connections by utilizing the pgSslAllowUnauthorized environment variable. When enabled, this allows SSL connections without certificate validation.
Key changes:
- Modified SSL configuration to conditionally set
rejectUnauthorized: falsebased on thepgSslAllowUnauthorizedflag - The configuration applies uniformly across development, production, and test environments
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/db/dbMigrator/dbMigrate.ts
Outdated
| ssl: ProcessEnv.pgSslAllowUnauthorized | ||
| ? { | ||
| rejectUnauthorized: false, | ||
| } | ||
| : ProcessEnv.pgSsl, |
There was a problem hiding this comment.
The SSL configuration change applies to all environments including production (see line 31 in getConfig). Allowing unauthorized SSL connections in production environments can expose the application to man-in-the-middle attacks and defeats the purpose of SSL/TLS encryption.
Consider whether pgSslAllowUnauthorized should only be respected in development/test environments, or add explicit warnings in documentation about the security implications of enabling this setting in production.
| ssl: ProcessEnv.pgSslAllowUnauthorized | |
| ? { | |
| rejectUnauthorized: false, | |
| } | |
| : ProcessEnv.pgSsl, | |
| ssl: | |
| ProcessEnv.nodeEnv !== 'production' && ProcessEnv.pgSslAllowUnauthorized | |
| ? { | |
| rejectUnauthorized: false, | |
| } | |
| : ProcessEnv.pgSsl, |
|
No description provided.