fix(client-certificates): reestablish a way to explicitly send no client certificate for an origin - #42547
Conversation
…empty client certificates list
…rage sendNone combined with cert/key/passphrase/pfx, or mixed with a real certificate on the same origin, now throws instead of silently resolving. Adds test coverage for sendNone across fetch, browser and persistentContext, and clarifies the docs.
|
Florian Schwalm (@egfx-notifications) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
| - `pfxPath` ?<[path]> Path to the PFX or PKCS12 encoded private key and certificate chain. | ||
| - `pfx` ?<[Buffer]> Direct value of the PFX or PKCS12 encoded private key and certificate chain. | ||
| - `passphrase` ?<[string]> Passphrase for the private key (PEM or PFX). | ||
| - `sendNone` ?<[boolean]> Explicitly send no client certificate for this origin. Must be the only field set besides `origin`. |
There was a problem hiding this comment.
The name reads oddly next to the other options, how about noCertificate?
| const secureContext = data[0] === 0x16 ? this.socksProxy.secureContextMap.get(normalizeOrigin(`https://${this.host}:${this.port}`)) : undefined; | ||
| if (secureContext) | ||
| this._establishTlsTunnel(this._browserEncrypted, data, secureContext); | ||
| if (data[0] === 0x16 && this.socksProxy.secureContextMap.has(normalizeOrigin(`https://${this.host}:${this.port}`))) |
There was a problem hiding this comment.
revert this part, it only increases duplication
Test results for "tests 1"6 flaky51358 passed, 1247 skipped Merge workflow run. |
Test results for "MCP"8301 passed, 1371 skipped Merge workflow run. |
Summary
Restores the ability to explicitly send no client certificate for an origin, fixing a regression from #41113 (first released in v1.61.0).
Details
sendNoneoption to theclientCertificatestest option so we can explicitly request sending no certificate to a server rather than relying on the previous implicit "clientCertificates set, but origin not mentioned in configured origins means intercept and send no certificate"Fixes #42546