1

I am developing a web API, which runs only on my local computer, and using PowerShell to test it. Here is an example test:

$baseUri = 'https://localhost:5001'

$body = '{
  "title": "Lofi Guitar Loop",
  "preview": "/media/mp3/21-10-06.mp3",
  "structure": "ABACA"
}'

$response = Invoke-WebRequest -Method 'POST' -Uri "$baseUri/sounds" -Body $body

if ($response.StatusCode -ne 201) {throw}
if (-not $response.Content) {throw}

However, I receive the error "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

To fix this, I came across some code that disables certificate checking:

  add-type @"
      using System.Net;
      using System.Security.Cryptography.X509Certificates;
      public class TrustAllCertsPolicy : ICertificatePolicy {
          public bool CheckValidationResult(
              ServicePoint srvPoint, X509Certificate certificate,
              WebRequest request, int certificateProblem) {
              return true;
          }
      }
"@
  [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

From what I understand, this is equivalent to using the "-k" parameter in curl. It indeed solves the error, but I want to know: Does this only affects my specific code or does it affect other programs too and thus results in a security vulnerability for my system.

3
  • Okay, so TLS is unnecessary on localhost, thanks! However, the question specifically asks if this code introduces a vulnerability, which the suggested posts don't seem to answer. I'm especially interested if the code makes changes that persist beyond its PowerShell session, or if the changes are restricted to its session's scope. Jun 18 at 15:29
  • I did not read the question this way initially. But I've reopened it and changed the wording slightly to make it more clear what you are asking. Jun 18 at 15:40
  • Great, cheers Steffen. In the meantime I'll do more research. Jun 18 at 15:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.