Authentication not detected on route processing payments

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

No authentication was detected for an API that processes payments. Attackers could abuse this endpoint to perform unauthorized actions, carding, or commit fraudulent activities.

Rationale

This finding works by identifying an API that is tracking a payment business logic event (tags containing the payment. prefix) but for which Datadog detected no authentication mechanism.

Remediation

  • Implement authentication to prevent non-intended users interaction with the API
  • To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.