SEC013
Disabled SSL certificate validation
Object Pascal — Delphi & Free Pascal
Error
Security
Disabling SSL validation exposes connections to man-in-the-middle attacks
disabling SSL validation exposes connections to man-in-the-middle attacks.
Why this severity
disabling SSL validation exposes connections to man-in-the-middle attacks.
Known false positives
test environments with self-signed certificates behind a firewall.
Remediation example
IdHTTP.IOHandler.SSLOptions.VerifyMode := [sslvrfPeer]; IdHTTP.IOHandler.SSLOptions.VerifyDepth := 2;