Is it secure to bypass security via NODE_ENV?

Question

Basically what I want to do is :

if (process.env.NODE_ENV === 'debug') {
    // bypass security check
} else {
    // security check
}

Is it safe ?

Answer 1

It's always better to remove security holes from your code, so what you've done is not 100% unsafe, but it's a single point of failure to being unsafe. You should at least use a two level system.

if (process.env.NODE_ENV === 'debug' && process.env.BYPASS_ALL_SECURITY === 'true') {
    // bypass security check
} else {
    // security check
}

In this way, you'd have to flip two switches. This prevents someone from turning on debug for another random reason and suddenly auth stops working. You have to do TWO whole things to break your security.

But the most secure thing is to not make security optional.