Use `https` protocol over `http`

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-express/https-protocol-missing

Language: TypeScript

Severity: Warning

Category: Security

CWE: 693

Description

Per Express documentation:

If your app deals with or transmits sensitive data, use Transport Layer Security (TLS) to secure the connection and the data. This technology encrypts data before it is sent from the client to the server, thus preventing some common (and easy) hacks.

This rule will detect the usage of non https.createServer() usage.

Non-Compliant Code Examples

import https from 'https';
import express, { Express } from 'express';

const app: Express = express();

var httpServer = http.createServer(app)
httpServer.listen(8080);

Compliant Code Examples

import https from 'https';
import express, { Express } from 'express';

const app: Express = express();

var httpsServer = https.createServer(app)
httpsServer.listen(8080);
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis