title: Avoid sending TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher in TLS Client Hello
body: <p>Node.js sends the <code>TLS_EMPTY_RENEGOTIATION_INFO_SCSV</code> cipher by default to protect itself against the <a href="https://en.wikipedia.org/wiki/POODLE">POODLE attack</a>.</p>
  
  <p>I'm trying to avoid sending this cipher (even though this may pose a security risk) by overriding the TLS ciphers with a custom list of ciphers.</p>
  
  <p>However, Node.js keeps sending the <code>TLS_EMPTY_RENEGOTIATION_INFO_SCSV</code> cipher no matter what I do. I'm trying to deliberately avoid sending this cipher to mimic the TLS negotiation of Firefox/Chrome.</p>
  
  <p>Here's the code I use to modify and check which ciphers Node is sending:</p>
  
  <pre><code>var request = require('request');
  
  var ciphers = [
      'ECDHE-ECDSA-AES128-GCM-SHA256',
      'ECDHE-RSA-AES128-GCM-SHA256',
      'ECDHE-ECDSA-AES256-SHA',
      'ECDHE-ECDSA-AES128-SHA',
      'ECDHE-RSA-AES128-SHA',
      'ECDHE-RSA-AES256-SHA',
      'DHE-RSA-AES128-SHA',
      'DHE-RSA-AES256-SHA',
      'AES128-SHA',
      'AES256-SHA',
      'DES-CBC3-SHA'
  ].join(':');
  
  var options = {
      ciphers: ciphers,
      secureProtocol: 'TLSv1_2_method',
      url: 'https://www.howsmyssl.com/a/check'
  };
  
  request(options, function (error, response, body){
      if (!error) {
          console.log(body);
      }
      else {
          console.log(error);
      }
  });
  </code></pre>
  
  <p>Is there any way to disable sending this cipher in Node.js?</p>