1

I run a dotnet 5 web api application which I want to call from my express web app. Think of it as a backend running on net5.0 and a front-end with a server running on nodejs and express.

My dotnet app uses a localhost certificate it generated and runs on https://localhost:5003.

My express app hosts a svelte front-end and runs on http://localhost:5005 (remark that the express app is not running on https). When I call my server I do something like:

const express = require('express');
const app = express();
const http = require("http");
const port = process.env.PORT || 5005;
const cors = require('cors');
const axios = require('axios');
const settings = require("./../settings");

const httpAgent = new http.Agent({
    // something needs to happen here!
});
axios.default.options = httpAgent;

// parse application/json
app.use(express.json());
app.use(cors());


app.post("/api/login", async (req, res) => {
    console.log(req.body);

    const { name, password } = req.body;

    var loginResponse = await axios.post(settings.server.url + "api/login", {
        userName: name,
        password: password
    });

    console.log(loginResponse);

    res.send(loginResponse);
});

The error I get is:

(node:15896) UnhandledPromiseRejectionWarning: Error: self signed certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1507:34)
    at TLSSocket.emit (events.js:376:20)
    at TLSSocket._finishInit (_tls_wrap.js:932:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:706:12)

I've found this question and some other ones, not worth mentioning atm, but I keep running up against blocks and I really do not want to "just ignore the certificates".

My localhost certificate is installed and I can find it in de certificates of my machine. I can't, however, physically find it on my machine searching for "localhost.crt".

My question is: How can I set up my httpAgent, so that when I use axios to call my back-end I call it using its https endpoint and not get an error?

Mr. Baudin
  • 2,104
  • 2
  • 16
  • 24
  • “I really do not want to "just ignore the certificates".” You can’t have it both ways. You either verify the certificates or you don’t. Anything in between is bad design. Can you elaborate on the why? – Slava Knyazev May 23 '21 at 07:09
  • An option to have a locally trusted self-issued CA, and go about it that way. But once again — I doubt that this is a desirable path. – Slava Knyazev May 23 '21 at 07:10
  • Could you please elaborate on your comments? I'm not trying to have it both ways. I'm running a dotnet core app with a self signed certificate and an express app with which I want to call said dotnet app and have no clue how to go about it in the correct way. My goal is to have a secure connection between the two, even in 'dev' – Mr. Baudin May 23 '21 at 07:36

0 Answers0