no-node-tls-legacy-protocol

Disallow legacy TLS protocol selection in Node.js TLS and HTTPS configuration.

Targeted pattern scope

This rule targets Node.js TLS and HTTPS option objects, plus assignments to tls.DEFAULT_MIN_VERSION or tls.DEFAULT_MAX_VERSION, when they select legacy protocols such as TLSv1, TLSv1.0, TLSv1.1, or legacy secureProtocol values like TLSv1_method.

What this rule reports

This rule reports legacy protocol selection through:

minVersion
maxVersion
secureProtocol
tls.DEFAULT_MIN_VERSION
tls.DEFAULT_MAX_VERSION

Why this rule exists

Allowing TLS 1.0 or TLS 1.1 weakens transport security and can re-enable obsolete protocol negotiation for outbound or inbound connections. Modern Node code should require TLS 1.2 or newer.

❌ Incorrect

import tls from "node:tls";
import https from "node:https";

tls.createSecureContext({ minVersion: "TLSv1.1" });
new https.Agent({ secureProtocol: "TLSv1_method" });
tls.DEFAULT_MIN_VERSION = "TLSv1";

✅ Correct

import tls from "node:tls";
import https from "node:https";

tls.createSecureContext({ minVersion: "TLSv1.2" });
new https.Agent({ secureProtocol: "TLSv1_2_method" });
tls.DEFAULT_MIN_VERSION = "TLSv1.2";

ESLint flat config example

import sdl from "eslint-plugin-sdl-2";

export default [
 {
  plugins: { sdl },
  rules: {
   "sdl/no-node-tls-legacy-protocol": "error",
  },
 },
];

When not to use it

Disable this rule only if you intentionally maintain legacy interoperability with endpoints that cannot support TLS 1.2 or newer, and that compatibility decision is documented and explicitly accepted as risk.

Package documentation

Rule source

Targeted pattern scope​

What this rule reports​

Why this rule exists​

❌ Incorrect​

✅ Correct​

ESLint flat config example​

When not to use it​

Package documentation​

Further reading​