Disable TLS verification via NODE_TLS_REJECT_UNAUTHORIZED or mock network with MSW in Vitest tests

Direct Answer

For Vitest testing with self-signed certificates, mock the network layer with MSW rather than disabling TLS verification globally. This approach isolates tests, avoids security risks, and maintains test reliability.

Why NODE_TLS_REJECT_UNAUTHORIZED is Problematic

Setting NODE_TLS_REJECT_UNAUTHORIZED=0 or process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0' disables certificate validation for the entire Node.js process. This creates:

• Security exposure: All HTTPS connections in the process become vulnerable to man-in-the-middle attacks
• Global side effects: Tests running in parallel may inadvertently affect each other
• Hidden dependencies: Tests may pass but fail in production due to real certificate issues

MSW as the Preferred Solution

MSW (Mock Service Worker) intercepts HTTP requests at the network layer, eliminating the need for actual TLS handshakes. Benefits include:

• Scoped mocking: Only tests that use MSW are affected
• No network dependency: Tests run reliably offline
• Security isolation: No global process state is modified

Implementation Steps

1. Install MSW: npm install msw --save-dev

2. Create a setup file (e.g., test/setupMSW.ts):

   import { setupServer } from 'msw/node';
   import { rest } from 'msw';
   
   const handlers = [
     rest.get('https://your-endpoint.com/api', (req, res, ctx) => {
       return res(ctx.json({ success: true }));
     }),
   ];
   
   export const server = setupServer(...handlers);
   
   beforeAll(() => server.listen());
   afterEach(() => server.resetHandlers());
   afterAll(() => server.close());
   

3. Configure Vitest to run the setup:

   // vitest.config.ts
   export default defineConfig({
     setupFiles: ['./test/setupMSW.ts'],
   });

When NODE_TLS_REJECT_UNAUTHORIZED Might Be Acceptable

Only consider this approach for end-to-end tests where you specifically need to validate TLS handshake behavior. For unit and integration tests, mocking is always preferable.

Vitest Configuration Limitations

Vitest does not provide a native tls or rejectUnauthorized configuration option. It relies entirely on Node.js runtime behavior, so TLS settings must be controlled via environment variables or runtime configuration.

Key Considerations

• Verify MSW setup: Ensure setupFiles in vitest.config.ts points to your MSW setup file
• Avoid environment variable commits: Use .env.test files that are gitignored if you must use TLS disabling
• Test both approaches: Write tests that would fail with real certificates to ensure your mocking is working correctly

One missing diagnostic detail: If you're seeing specific TLS errors beyond certificate validation, please share the error message to determine if additional Node.js agent configuration is needed.