JSS/NextJS: how to disable SSL cert validation via ProxyConfig.proxyOptions.secure setting

Question

I'm running in connected mode on my local and I want to disable SSL cert validation. According to the Sitecore docs, this option is mentioned:

... in the SSR application jss-proxy-ssr, in the config.js file, in the proxyOptions object, you can disable SSL validation entirely by setting the secure to false option. For example:

proxyOptions: {

  // Setting this to false will disable SSL certificate validation
  // when proxying to a SSL Sitecore instance.
  // This is a major security issue, so NEVER EVER set this to false
  // outside local development. Use a real CA-issued certificate.
  // NEVER EVER do this in production. It will make your SSL completely insecure.
  
  secure: false
}

It's not clear how to actually do this. I started by searching for proxyOptions in the JSS repo. I looked into making the change in bootstrap.ts via the configOverride var, but it's only a simple list of key value pairs which doesn't appear to support tunnelling into ProxyConfig.proxyOptions.secure:

const configOverride: { [key: string]: string } = {};

Answer 1

The ProxyConfig.proxyOptions.secure setting likely isn't applicable in this case because there is no proxy involved. Also, as the docs state, disabling SSL isn't a great practice.

Instead of trying to disable SSL validation to fix my issues, I opted to make SSL validation work by adding my SIF Trusted Root certificate to Node. In short:

setx NODE_EXTRA_CA_CERTS C:\some\path\to\my-shiny-sif-certificate.cer

Sitecore has a solid guide:

https://doc.sitecore.com/xp/en/developers/hd/200/sitecore-headless-development/walkthrough--configuring-sitecore-ca-certificates-for-node-js.html

I also wrote a bit more about this subject:

https://sitecore.marcelgruber.ca/posts/nextjs-unable-verify-first-certificate