Improper Certificate Validation

// http/NaiveTrustManager.java
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

// DANGEROUS: Trust manager that accepts any certificate. NEVER use in production.
public class NaiveTrustManager implements X509TrustManager {
    public void checkClientTrusted(X509Certificate[] certs, String authType) {}
    public void checkServerTrusted(X509Certificate[] certs, String authType) {} // Accepts anything!
    public X509Certificate[] getAcceptedIssuers() { return null; }
}

// http/ApiClient.java
import javax.net.ssl.*; // Other imports...

public void callApiUnsafe() throws Exception {
    SSLContext sslContext = SSLContext.getInstance("TLS");
    // DANGEROUS: Initializing SSLContext with the naive trust manager.
    sslContext.init(null, new TrustManager[]{ new NaiveTrustManager() }, null);

    HttpsURLConnection connection = (HttpsURLConnection) new URL("[https://unsafe.example.com](https://unsafe.example.com)").openConnection();
    // Applies the naive trust manager globally or per connection
    connection.setSSLSocketFactory(sslContext.getSocketFactory());
    // Hostname verification might also be disabled separately (another vuln!)
    connection.setHostnameVerifier((hostname, session) -> true); // DANGEROUS

    // Connection proceeds even if cert is invalid/wrong host/self-signed.
    connection.connect();
    // ... read response ...
}

// http/ApiClientHostnameBypass.java
public void callApiHostnameBypass() throws Exception {
    // Assume default SSLContext (validates chain)
    HttpsURLConnection connection = (HttpsURLConnection) new URL("[https://trusted.example.com](https://trusted.example.com)").openConnection();

    // DANGEROUS: Disables the check ensuring the cert is actually for trusted.example.com.
    // Attacker presents valid cert for attacker.com, validation passes.
    connection.setHostnameVerifier((hostname, session) -> true);

    connection.connect(); // Connects to MitM server presenting attacker.com cert
    // ... read response ...
}

// http/ApiClientSecure.java
import javax.net.ssl.HttpsURLConnection;
import java.net.URL;
// ... other imports ...

public void callApiSecure() throws Exception {
    // SECURE: Use default SSLContext and TrustManager.
    // This validates against JVM's cacerts and performs hostname verification.
    HttpsURLConnection connection = (HttpsURLConnection) new URL("[https://secure.example.com](https://secure.example.com)").openConnection();

    // No need to set custom TrustManager or HostnameVerifier for standard validation.
    connection.connect(); // Will throw SSLException if validation fails

    // ... read response ...
}

// Example with Custom Trust Store (if needed for internal CA)
// KeyStore trustStore = KeyStore.getInstance("JKS");
// trustStore.load(new FileInputStream("/path/to/my/truststore.jks"), "password".toCharArray());
// TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
// tmf.init(trustStore);
// SSLContext sslContext = SSLContext.getInstance("TLS");
// sslContext.init(null, tmf.getTrustManagers(), null);
// connection.setSSLSocketFactory(sslContext.getSocketFactory());
// Hostname verification is still enabled by default.

// Services/ApiClient.cs
using System.Net.Http;
using System.Net.Security; // For SslPolicyErrors
using System.Security.Cryptography.X509Certificates; // For X509Certificate2

public class ApiClient
{
    private readonly HttpClient _httpClient;

    public ApiClient()
    {
        // DANGEROUS: Callback always returns true, accepting any certificate.
        var handler = new HttpClientHandler
        {
            ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
        };
        _httpClient = new HttpClient(handler);
    }

    public async Task CallApiUnsafe(string url)
    {
        // Connection succeeds even with invalid certs due to callback override.
        var response = await _httpClient.GetAsync(url);
        // ... process response ...
    }
}

// Program.cs or Startup.cs (Legacy approach - VERY DANGEROUS)
using System.Net;
// ... other imports ...

// DANGEROUS: Globally disables certificate validation for the entire application domain.
ServicePointManager.ServerCertificateValidationCallback += (sender, certificate, chain, sslPolicyErrors) => true;

// Services/ApiClient.cs (Secure - Default Validation)
using System.Net.Http;
using System.Threading.Tasks;

public class ApiClientSecure
{
    private readonly HttpClient _httpClient;

    public ApiClientSecure()
    {
        // SECURE: Use default HttpClientHandler (or omit handler).
        // It performs standard certificate validation using OS trust store.
        _httpClient = new HttpClient();
    }

    public async Task CallApiSecure(string url)
    {
        try
        {
            // Connection will fail with HttpRequestException (inner SSLException) if cert is invalid.
            var response = await _httpClient.GetAsync(url);
            response.EnsureSuccessStatusCode(); // Check for HTTP errors
            // ... process response ...
        }
        catch (HttpRequestException ex) when (ex.InnerException is System.Security.Authentication.AuthenticationException)
        {
             Console.WriteLine($"Certificate validation failed: {ex.InnerException.Message}");
             // Handle validation failure
        }
        // ... handle other exceptions ...
    }
}

// Secure Custom Validation Callback (Example: Pinning - simplified)
// var handler = new HttpClientHandler {
//     ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => {
//         // SECURE: Check standard errors first
//         if (errors != SslPolicyErrors.None) {
//             Console.WriteLine($"Cert Error: {errors}");
//             return false;
//         }
//         // SECURE: Perform custom check (e.g., check public key matches expected pinned key)
//         string expectedPublicKey = "YOUR_EXPECTED_PUBLIC_KEY_HASH_OR_FULL_KEY";
//         string actualPublicKey = cert.GetPublicKeyString(); // Example
//         if (actualPublicKey == expectedPublicKey) {
//              return true; // Pinned key matches
//         }
//         Console.WriteLine("Certificate pinning failed.");
//         return false;
//     }
// };
// _httpClient = new HttpClient(handler);

<?php
// api_client.php
$url = "[https://internal-api.example.com/data](https://internal-api.example.com/data)";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// DANGEROUS: Disables verification of the server's certificate chain.
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
// DANGEROUS: Disables hostname verification (might also need VERIFYHOST = 0).
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

$response = curl_exec($ch); // Connects even if cert is invalid/MitM
if(curl_errno($ch)){ echo 'Curl error: ' . curl_error($ch); }
curl_close($ch);
// ... process $response ...
?>

<?php
// api_reader.php
$url = "[https://api.example.com/](https://api.example.com/)";
$options = [
    "ssl" => [
        // DANGEROUS: Disables peer certificate verification.
        "verify_peer" => false,
        // DANGEROUS: Disables peer name (hostname) verification.
        "verify_peer_name" => false,
    ],
];
// Create stream context with unsafe options
$context = stream_context_create($options);
// DANGEROUS: Request made without proper certificate validation.
$response = file_get_contents($url, false, $context);
// ... process $response ...
?>

<?php
// api_client.php (Secure curl)
$url = "[https://secure.example.com/data](https://secure.example.com/data)";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// SECURE: Explicitly enable peer verification (often default, but explicit is good).
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
// SECURE: Explicitly enable hostname verification (value should be 2).
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

// Optional: Specify CA bundle if needed (paths vary by OS)
// curl_setopt($ch, CURLOPT_CAINFO, '/etc/ssl/certs/ca-certificates.crt');

$response = curl_exec($ch);
if(curl_errno($ch)){
    // Error here likely indicates validation failure (among other things)
    echo 'Curl error: ' . curl_error($ch);
}
curl_close($ch);
// ... process $response ...

// api_reader.php (Secure stream context)
$url = "[https://secure.example.com/](https://secure.example.com/)";
$options = [
    "ssl" => [
        // SECURE: Rely on defaults (true) or set explicitly.
        "verify_peer" => true,
        "verify_peer_name" => true,
        // Optional: Specify CA file if needed
        // "cafile" => "/etc/ssl/certs/ca-certificates.crt",
    ],
];
$context = stream_context_create($options);
// Connection will fail if validation fails. Use try/catch.
try {
     $response = file_get_contents($url, false, $context);
     // ... process $response ...
} catch (Exception $e) {
     echo "Connection failed (possibly cert validation): " . $e->getMessage();
}
?>

// api_client_https.js
const https = require('https');

const options = {
  hostname: 'untrusted-cert.example.com',
  port: 443,
  path: '/',
  method: 'GET',
  // DANGEROUS: Disables certificate chain and hostname validation.
  rejectUnauthorized: false
};

const req = https.request(options, (res) => {
  // Response received even if cert is invalid/MitM
  // ... process response ...
});
req.on('error', (e) => { console.error(`HTTPS request error: ${e}`); });
req.end();

// api_client_axios.js
const axios = require('axios');
const https = require('https');

// DANGEROUS: Creating an agent that bypasses certificate validation.
const unsafeAgent = new https.Agent({
  rejectUnauthorized: false
});

async function callApiUnsafe() {
  try {
    const response = await axios.get('[https://wrong.host.example.com/](https://wrong.host.example.com/)', {
      httpsAgent: unsafeAgent // Using the insecure agent
    });
    // Request succeeds despite invalid cert/hostname.
    console.log(response.data);
  } catch (error) {
    // This might catch network errors, but not cert validation errors
    console.error('Axios error:', error.message);
  }
}

// api_client_https.js (Secure)
const https = require('https');
const fs = require('fs'); // For loading custom CA if needed

const options = {
  hostname: 'secure.example.com',
  port: 443,
  path: '/',
  method: 'GET',
  // SECURE: Rely on default validation (rejectUnauthorized is true by default).
  // rejectUnauthorized: true // Explicit default

  // Optional: Provide custom CA if needed
  // ca: fs.readFileSync('/path/to/internal-ca.crt')
};

const req = https.request(options, (res) => {
  // Only runs if validation succeeds
  // ... process response ...
});
req.on('error', (e) => {
  // Errors like CERT_UNTRUSTED or HOSTNAME_MISMATCH will be caught here
  console.error(`HTTPS request error (Validation may have failed): ${e}`);
});
req.end();

// api_client_axios.js (Secure)
async function callApiSecure() {
  try {
    // SECURE: Use default httpsAgent which performs validation.
    const response = await axios.get('[https://secure.example.com/](https://secure.example.com/)');
    // Or provide custom CA via agent if needed:
    // const secureAgent = new https.Agent({ ca: fs.readFileSync('/path/to/ca.crt') });
    // const response = await axios.get('...', { httpsAgent: secureAgent });

    console.log(response.data);
  } catch (error) {
    // Catches connection errors AND certificate validation errors
    console.error('Axios error:', error.message);
  }
}

# api_client.rb
require 'net/http'
require 'uri'

uri = URI.parse("[https://self-signed.internal.example.com/](https://self-signed.internal.example.com/)")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
# DANGEROUS: Disables certificate validation entirely.
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Get.new(uri.request_uri)
begin
  response = http.request(request) # Connects despite invalid cert
  # ... process response ...
rescue => e
  puts "Request failed: #{e.message}"
end

# httparty_client.rb
require 'httparty'

class MyApiClient
  include HTTParty
  base_uri '[https://wrong-host.example.com](https://wrong-host.example.com)'

  # DANGEROUS: Globally disabling verification for this client.
  no_ssl_peer_verification # Deprecated alias for verify: false

  # OR using options per request:
  def get_data_unsafe(path)
    # DANGEROUS: verify: false disables checks for this request.
    self.class.get(path, verify: false)
  end
end

# api_client.rb (Secure Net::HTTP)
require 'net/http'
require 'uri'
require 'openssl' # For constants

uri = URI.parse("[https://secure.example.com/](https://secure.example.com/)")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
# SECURE: Rely on default (VERIFY_PEER) or set explicitly.
http.verify_mode = OpenSSL::SSL::VERIFY_PEER

# Optional: Specify CA file/path if needed
# http.ca_file = '/path/to/ca.pem'
# http.ca_path = '/etc/ssl/certs'

request = Net::HTTP::Get.new(uri.request_uri)
begin
  response = http.request(request) # Fails if validation fails
  # ... process response ...
rescue OpenSSL::SSL::SSLError => e
  puts "SSL Validation Error: #{e.message}"
rescue => e
  puts "Request failed: #{e.message}"
end

# httparty_client.rb (Secure HTTParty)
require 'httparty'

class MySecureApiClient
  include HTTParty
  base_uri '[https://secure.example.com](https://secure.example.com)'

  # SECURE: Rely on default verify: true.
  # Or explicitly: default_options verify: true

  # Optional: Specify CA file globally if needed
  # ssl_ca_file '/path/to/ca.pem'

  def get_data_secure(path)
    # SECURE: Uses default verification settings.
    # Request will raise SSLError on validation failure.
    begin
         self.class.get(path)
         # Or specify CA per request: self.class.get(path, ssl_ca_file: '/path/ca.pem')
    rescue OpenSSL::SSL::SSLError => e
         puts "SSL Error: #{e.message}"
         nil # Handle error
    end
  end
end