1 files changed, 7 insertions, 1 deletions
diff --git a/lib/webhooks.ts b/lib/webhooks.ts
index 2a888991..d724ccdf 100644
--- a/lib/webhooks.ts
+++ b/lib/webhooks.ts
@@ -12,6 +12,13 @@ export const callWebhook = async (invoice, payment) => {
       const { amount, confirmed, hash, memo } = payment;
 
       l("calling webhook", webhook, amount, hash, address, text);
+      // TLS verification stays ON. This body carries `secret` — the shared
+      // value the merchant uses to authenticate the notification — so with
+      // rejectUnauthorized:false any party able to intercept the connection
+      // could present its own certificate, harvest the secret, and then forge
+      // "payment received" callbacks to that merchant. A merchant on a
+      // self-signed cert now fails here instead, which the catch below logs;
+      // the payment itself is unaffected.
       const res = await got.post(webhook, {
         json: {
           address,
@@ -23,7 +30,6 @@ export const callWebhook = async (invoice, payment) => {
           text,
           secret,
         },
-        https: { rejectUnauthorized: false },
       });
       return res;
     }