From 2771abc6a718fe3ea8ccf85e8061504f2d0719a0 Mon Sep 17 00:00:00 2001
From: Leon Acosta <leon@dandelionlabs.io>
Date: Sat, 4 Jul 2026 18:45:45 +0700
Subject: [PATCH] verify Kafka broker TLS certificate by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When SASL credentials are present, getClient() connected with
`rejectUnauthorized: false`, so the SASL password was sent over a TLS
connection whose broker certificate was never verified — a MITM could
present any certificate and capture the credentials.

Verify by default; set KAFKA_SSL_ALLOW_UNAUTHORIZED=true to opt out for
self-signed brokers.
---
 src/lib/kafka.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/kafka.ts b/src/lib/kafka.ts
index c8c3220bc..3e25eae4d 100644
--- a/src/lib/kafka.ts
+++ b/src/lib/kafka.ts
@@ -47,7 +47,7 @@ function getClient() {
     username && password
       ? {
           ssl: {
-            rejectUnauthorized: false,
+            rejectUnauthorized: process.env.KAFKA_SSL_ALLOW_UNAUTHORIZED !== 'true',
           },
           sasl: {
             mechanism,