Fallback to non-SSL connection

[gabegorelick]

The default sslmode in libpq is prefer:

first try an SSL connection; if that fails, try a non-SSL connection

It should be possible to have similar fallback behavior in node-postgres.

Currently, the following will fail with a The server does not support SSL connections error if the DB does not support TLS:

const client = new Client({ ssl: { rejectUnauthorized: true } });
await client.connect();

This requires knowing ahead of time whether the server supports TLS or not, even if we don't care about TLS.

[charmander]

This requires knowing ahead of time whether the server supports TLS or not, even if we don't care about TLS.

Not ruling out support, but: if you don’t care about TLS, don’t turn it on. If it’s a connection where it makes sense to have TLS, don’t be vulnerable to MITM to save one environment variable that distinguishes production from development or whatever the case may be.

[gabegorelick]

if you don’t care about TLS, don’t turn it on.

There's a use case for connecting to a server where you don't know whether it's listening on TLS or not, as evidenced by libpq's support for this use case. In those cases, you often don't care about verifying the cert because you were happy to connect without TLS anyway. This can be a OK if the connection is secured at a different layer.

E.g. someone gives you a secure tunnel to their DB along with connection info, but neglected to specify if they're using TLS. This is pretty common, since people know to provide hostname, port, username, password, DB name, etc but often forget about ssl mode and certs. Or they, rightly or wrongly, just don't want to worry about certs since everything is already tunneled.

[oren-nonamesecurity]

+1
We don't always know in advance where our code will be used, and external DB is allowed.
A "prefer"/"allow" logic is missing here.

[Themanwithoutaplan]

There's always a risk associated with dropping down or disabling SSL so this should ideally be controlled parametrically. After playing around it seems the best option is to explicitly pass ssl = false