Axios ignores NODE_TLS_REJECT_UNAUTHORIZED when a custom httpsAgent is provided

Answer

Axios will not read NODE_TLS_REJECT_UNAUTHORIZED when you supply a custom httpsAgent. The environment variable is only consulted by Axios when it creates its own default agent.

Why this happens (confirmed facts)

• When Axios builds the request options, it passes the provided httpsAgent straight to Node’s https.request.
• Axios does not inspect or modify the agent’s rejectUnauthorized property.
• The rejectUnauthorized flag on an https.Agent is read only at agent construction time; changing NODE_TLS_REJECT_UNAUTHORIZED later has no effect.

What you should do (steps)

1. Determine whether you need to relax TLS checks for the request.
2. If you are using a custom agent, set its rejectUnauthorized property explicitly based on the environment variable:

const https = require('https');
const rejectUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0';
const customAgent = new https.Agent({ rejectUnauthorized });

3. Pass customAgent to Axios via the httpsAgent option.
4. If you prefer Axios to handle the variable automatically, omit the custom agent for those requests; Axios will then create its own agent that respects NODE_TLS_REJECT_UNAUTHORIZED.

Verification

Run a quick test:

process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
const axios = require('axios');
const https = require('https');
const agent = new https.Agent({ rejectUnauthorized: true }); // explicit true
axios.get('https://self-signed.badssl.com/', { httpsAgent: agent })
  .then(() => console.log('unexpected success'))
  .catch(err => console.error('expected error:', err.code));

You should see UNABLE_TO_VERIFY_LEAF_SIGNATURE. Changing rejectUnauthorized to false makes the request succeed, proving the agent controls validation.