Security flaw in WebSocket TLS client authentication

[ghost]

Hardcoding the rejectUnauthorized option in lib/transport/websocket.js to false exposes autobahn-js clients to man-in-the-middle attacks, as server certificates are never verified against the list of supplied certificate authorities.

In production environments, the rejectUnauthorized option must always default to true, not false. This option is passed through to https.request in Node.js and overwrites its default value which is true.

If you are using a self-signed server certificate in development or test environments, you should be able to pass the rejectUnauthorized: false option.

Fix:

• Extend tlsConfiguration options by an optional rejectUnauthorized option.
• If this option is not specified, pass rejectUnauthorized: true.
• Document this option in your API reference - Options that control tls connection explaining implications when setting it to false.

Thanks for providing a patch release fixing this issue!
Hubertus