title: NODE_TLS_REJECT_UNAUTHORIZED Heroku App making whole app insecure
body: <p>I have an app on Heroku that uses a paid dyno and thus uses their ACM <a href="https://devcenter.heroku.com/articles/automated-certificate-management" rel="nofollow noreferrer">Automated Certificate Management</a></p>
  
  <p>This should ensure all traffic between clients and the app are encrypted.</p>
  
  <p>However, my app makes callouts to a separate private API. I'm awaiting a separate self-signed certificate just to be able to connect to this API (so this should all be separate from the Heroku cert). As a temporary workaround..all connections to this API are currently used with </p>
  
  <p><code>process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';</code></p>
  
  <p>I've read about the dangers of this and how to makes all of node unencrypted. My question is if the app is still secure when clients connect to the Heroku instance for other parts of the app not involving the API callouts. Or does setting that env var really make the whole app insecure regardless of the Heroku cert?</p>
  
  <p>Thanks!</p>