diff --git a/lib/webpack/rails/manifest.rb b/lib/webpack/rails/manifest.rb
index 7226b67..10f29d9 100644
--- a/lib/webpack/rails/manifest.rb
+++ b/lib/webpack/rails/manifest.rb
@@ -66,7 +66,7 @@ def load_dev_server_manifest
           port = ::Rails.configuration.webpack.dev_server.manifest_port
           http = Net::HTTP.new(host, port)
           http.use_ssl = ::Rails.configuration.webpack.dev_server.https
-          http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+          http.verify_mode = ::Rails.configuration.webpack.dev_server.https_verify_peer ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
           http.get(dev_server_path).body
         rescue => e
           raise ManifestLoadError.new("Could not load manifest from webpack-dev-server at http://#{host}:#{port}#{dev_server_path} - is it running, and is stats-webpack-plugin loaded?", e)
diff --git a/lib/webpack/railtie.rb b/lib/webpack/railtie.rb
index 864a07a..fea1bd7 100644
--- a/lib/webpack/railtie.rb
+++ b/lib/webpack/railtie.rb
@@ -30,7 +30,9 @@ class Railtie < ::Rails::Railtie
     config.webpack.dev_server.manifest_host = 'localhost'
     config.webpack.dev_server.manifest_port = 3808
 
-    config.webpack.dev_server.https = false # note - this will use OpenSSL::SSL::VERIFY_NONE
+    config.webpack.dev_server.https = false
+    # change below option to false if you don't care about security
+    config.webpack.dev_server.https_verify_peer = true
     config.webpack.dev_server.binary = 'node_modules/.bin/webpack-dev-server'
     config.webpack.dev_server.enabled = !::Rails.env.production?