Authentication not detected on route returning non-sensitive PII data
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Description
No authentication was detected for an API that provides access to non-sensitive personally identifiable information (PII).
PII is information that can identify a user but, in isolation, could not cause significant harm to a person if leaked or stolen.
This information includes full name, email address or phone numbers.
Note: Datadog is only able to detect certain types of PII.
Rationale
This finding works by identifying an API that both:
- Datadog detected no authentication mechanism.
- Replies with or accepts requests containing email addresses or phone numbers.
- Validate that the code isn’t expecting the user to be authenticated to have access to this resource (AuthN). In case this API is in fact authenticated, ensure your code is instrumented correctly. Datadog auto-instruments many event types; review your instrumented business logic events.
- Validate whether the API is intended to return PII.
- To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.
References
