Description

This rule identifies when an exposed authentication route works over a non-encrypted channel.

Using plain HTTP for APIs is a significant security risk because it exposes sensitive data to potential interception, manipulation, and unauthorized access. Services must only provide HTTPS endpoints.

Rationale

This finding works by identifying an API that:

• Is tracking an user login business logic event (tag users.login.success or users.login.failure).
• Is processing traffic from the internet.
• Uses an HTTP connection, sending data in the clear over the wire.

Remediation

• Implement the HTTP Strict Transport Security (HSTS) header to instruct the user’s browser to always request the site over HTTPS.

References