require-tls-connection

Keywords: CWE-295, TLS, SSL, encryption, MongoDB, MitM, security

⚠️ This rule warns by default in the recommended config.

Quick Summary

Rule Details

MongoDB connections without TLS are vulnerable to:

• Man-in-the-Middle (MitM) attacks
• Credential interception
• Data exfiltration during transit

❌ Incorrect

// No TLS enabled
mongoose.connect('mongodb://localhost:27017/db');

// Explicit TLS disabled
mongoose.connect(uri, { tls: false });

// Legacy ssl option disabled
mongoose.connect(uri, { ssl: false });

✅ Correct

const x = 1;

Known False Positives

Local Development

// FP: Intentionally no TLS for local dev
mongoose.connect('mongodb://localhost:27017/devdb');

Workaround: Use allowInTests: true or configure environment-specific rules.

Known False Negatives

Dynamic Configuration

// ❌ NOT DETECTED
const options = getConfig();
mongoose.connect(uri, options); // TLS may or may not be enabled

When Not To Use It

• Local development with Docker containers
• Test environments with ephemeral databases
• Environments where TLS is handled at network level (VPC, SSH tunnel)

References

• MongoDB TLS/SSL Configuration
• CWE-295