getPeerCertificate() is an empty object when using dev server

[patorjk]

I've got an Express server that's set up to use PKI authentication for the users (corp app where all users have certs in their browser). For my create-react-app setup, I've updated package.json to proxy requests to the Express server, but it looks like the dev server doesn't pass along the user's cert. When my authentication code runs on the Express server, and the app is accessed through the webpack dev server, an empty object is returned: (though it works fine when accessing the Express server API directly through the browser)

var peerCertificate = req.connection.getPeerCertificate()

I don't see a way to to configure things so that this information gets passed along too. Am I missing something or doing something incorrectly? Or is this something that could be added in?

[SpaceK33z]

Could you find out for me if this also happens when using webpack-dev-server directly? I'm the maintainer of webpack-dev-server and could fix this if it is an issue in our package.

[patorjk]

I created a light weight app using just webpack-dev-server and got the same issue. I can't cut and paste, so I just re-typed it below. The app it's trying to proxy to is running on port 8080 (on the same box as this app) and is running using expressjs.

var webpack = require('webpack');
var WebpackDevServer = require('webpack-dev-server');
var fs = require('fs');
var splitca = require('split-ca');

var compiler = webpack({
    context: __dirname,
    entry: './entry',
    output: {
        path: __dirname + '/dist',
        filename: 'bundle.js'
    }
});

var devServer = new WebpackDevServer(compiler, {
    proxy: {
        '*': {
            target: 'https:// ... :8080',
            secure: false
        }
    },
    https: {
        key: fs.readFileSync('file_name_here'),
        cert: fs.readFileSync('file_name_here'),
        ca: splitca('file_name_here')
    }
});

devServer.listen(3000);

The expressjs app gets the request, but peerCertificate object is empty.

[SpaceK33z]

Okay, AFAIK that's not really a bug (at least not in WDS). webpack-dev-server only passes through the certificates and uses the standard https.createServer from Node.js.

[patorjk]

Would it be possible to additionally make the "headers" option in the WebDevServer configuration a function that took in the request object and returned an object for the headers? If so, I could set a header with the needed information from the user's cert and that could get passed along to the expressjs server.

The expressjs server reading a header for the user cert information wouldn't be secure for production, but it should be fine for development, and this technique seems to be popular for getting around this kind of situation [1, 2, 3].

[1] http://www.zeitoun.net/articles/client-certificate-x509-authentication-behind-reverse-proxy/start
[2] http://serverfault.com/questions/622855/nginx-proxy-to-back-end-with-ssl-client-certificate-authentication
[3] http://webcache.googleusercontent.com/search?q=cache:IaZk_nEeCyIJ:www.gossamer-threads.com/lists/apache/users/350827+&cd=7&hl=en&ct=clnk&gl=us

[SpaceK33z]

Sure, I'll accept a PR for that ;).

[gaearon]

I’m going to close since it doesn’t appear like there’s anything actionable here for this repo.
Let me know if I’m wrong!