tls: warn on NODE_TLS_REJECT_UNAUTHORIZED = '0'

[cjihrig]

Warn on the first request that sets the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0'.

Refs: #21774

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

[nodejs-github-bot]

@cjihrig build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/320/pipeline

[mscdex]

Can we reverse this equality check?: process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0'

[ChALkeR]

«is considered insecure» is too broad, imo.

Perhaps something among the lines «makes tls connections and https requests insecure»?

[joepie91]

Possibly even add "by disabling certificate verification" or so, because my experience is that people using this option almost never actually know what it does... and have just enabled it because a code example suggested it / a StackOverflow answer told them to / their boss told them to / etc.

[ChALkeR]

Yes, makes tls connections and https requests insecure by disabling certificate verification looks much better to me :-).

[cjihrig]

Green CI: https://ci.nodejs.org/job/node-test-pull-request/15973/

[ChALkeR]

Belated LGTM, the comments were addressed.

[targos]

This has no label. Should it be semver-minor? Or at least a notable-change?

[targos]

^ @cjihrig@ChALkeR
I ask for the changelog.

[mscdex]

Yeah, this should have been semver-major I believe.

[cjihrig]

Yeah, as a new warning, I think semver-major might be appropriate.

[targos]

OK I added the label

[ChALkeR]

@mscdex@targos I am fine with either semver-major or semver-minor/notable-change.