"Enable TLS" for Heroku Redis by ignoring self-signed TLS certificates (#17911)

* 'Enable TLS' for Heroku Redis by ignoring self-signed TLS certificates when creating Redis connections

https://devcenter.heroku.com/articles/heroku-redis#ioredis-module

* Clarify comments

Author: JamesMGreene

lib/redis-accessor.js

@@ -23,7 +23,14 @@ class RedisAccessor {
     }
 
     const redisClient = useRealRedis
-      ? new Redis(REDIS_URL, { ...redisBaseOptions, db: databaseNumber })
+      ? new Redis(REDIS_URL, {
+          ...redisBaseOptions,
+          db: databaseNumber,
+          tls: {
+            // Required for production Heroku Redis
+            rejectUnauthorized: false
+          }
+        })
       : new InMemoryRedis()
 
     this._client = redisClient

middleware/rate-limit.js

@@ -18,7 +18,11 @@ module.exports = rateLimit({
   // When available, use Redis
   store: REDIS_URL && new RedisStore({
     client: new Redis(REDIS_URL, {
-      db: rateLimitDatabaseNumber
+      db: rateLimitDatabaseNumber,
+      tls: {
+        // Required for production Heroku Redis
+        rejectUnauthorized: false
+      }
     }),
     // 1 minute (or practically unlimited outside of production)
     expiry: isProduction ? EXPIRES_IN_AS_SECONDS : 1 // Redis configuration in `s`

script/purge-redis-pages.js

@@ -42,7 +42,13 @@ console.log({
 purgeRenderedPageCache()
 
 function purgeRenderedPageCache () {
-  const redisClient = new Redis(REDIS_URL, { db: pageCacheDatabaseNumber })
+  const redisClient = new Redis(REDIS_URL, {
+    db: pageCacheDatabaseNumber,
+    tls: {
+      // Required for production Heroku Redis
+      rejectUnauthorized: false
+    }
+  })
   let totalKeyCount = 0
   let iteration = 0