Authentication not detected on route returning non-sensitive PII data
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Description
No authentication was detected for an API that provides access to non-sensitive personally identifiable information (PII).
PII is information that can identify a user but, in isolation, could not cause significant harm to a person if leaked or stolen.
This information includes full name, email address or phone numbers.
Note: Datadog is only able to detect certain types of PII.
Rationale
This finding works by identifying an API that both:
- Datadog detected no authentication mechanism.
- Replies with or accepts requests containing email addresses or phone numbers.
- Validate that the code isn’t expecting the user to be authenticated to have access to this resource (AuthN). In case this API is in fact authenticated, ensure your code is instrumented correctly. Datadog auto-instruments many event types; review your instrumented business logic events.
- Validate whether the API is intended to return PII.
- To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.
References
