Repository: node
Issue: Reloading page bypasses TLS client authentication
Labels: tls,doc

<!--
Thank you for reporting an issue.

This issue tracker is for bugs and issues found within Node.js core.
If you require more general support please file an issue on our help
repo. https://github.com/nodejs/help


Please fill in as much of the template below as you're able.

Version: output of `node -v`
Platform: output of `uname -a` (UNIX), or version and 32 or 64-bit (Windows)
Subsystem: if known, please specify affected core module name
-->

* **Version**: v12.18.3
* **Platform**: Linux 5.8.8-100.fc31.x86_64 #1 SMP Wed Sep 9 20:29:23 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
* **Subsystem**: 

### What steps will reproduce the bug?
- Obtain (or create) a CA certificate, a server certificate, and a server key supplied by said CA.
- Compile (with typescript) and run the following code:
```
import fs from 'fs';
import path from 'path';
import https from 'https';
import tls from 'tls';
import express from 'express';

/* Alias environment variables */
const port = process.env.PORT || 443;

const httpsOptions = {
    key: fs.readFileSync(path.join('certs', 'server.key')),
    cert: fs.readFileSync(path.join('certs', 'server.crt')),
    ca: fs.readFileSync(path.join('certs', 'ca.crt')),
    requestCert: true,
    rejectUnauthorized: false /* This is necessary to accept self-signed certificates, we will perform the authentication ourselves */
};

/* Create Express app */
const expressApp = express();
const expressServer = https.createServer(httpsOptions, expressApp);

expressApp.use((req,res,next) => {
    console.log((req.socket as tls.TLSSocket).authorized ? 'true' : 'false');
    if (!(req.socket as tls.TLSSocket).authorized) {
        return res.status(401).send('Unauthorized');
    }
    next();
});

expressServer.listen(port, () => {
    console.log(`Server listening on port ${port}`);
});
```
- Open Firefox (version 80) and go to https://localhost. You should have your connection rejected (output is 'false').
- Reload the page. Your connection is now accepted (output is 'true').
- This curiously doesn't happen on Chromium.

<!--
Enter details about your bug, preferably a simple code snippet that can be
run using `node` directly without installing third-party dependencies.
-->

### How often does it reproduce? Is there a required condition?
- Always reproducible. Chromium seems to not trigger the issue.

### What is the expected behavior?
- Connection should always be rejected

<!--
If possible please provide textual output instead of screenshots.
-->

### What do you see instead?
- Connection is accepted after page reload

<!--
If possible please provide textual output instead of screenshots.
-->

### Additional information
- According to documentation at https://nodejs.org/api/tls.html#tls_tlssocket_authorized the `(req.socket as tls.TLSSocket).authorized` flag should always be false if the client certificate doesn't match the server CA. In this case it becomes true after a page reload from Firefox for unknown reasons.
- This issue is described also in a stack overflow entry: https://stackoverflow.com/questions/60367338/result-of-req-socket-authorized-is-not-correct-using-nodejs-https-and-express
- I'm guessing it might be due to some TLS connection reuse logic.

<!--
Tell us anything else you think we should know.
-->