Metadata

ID: apex-security/no-http

Language: Apex

Severity: Warning

Category: Security

CWE: 319

Description

This rule flags the use of HTTP URLs in Apex code. Using HTTP instead of HTTPS can expose data transmitted between the client and server to interception or tampering, leading to potential security vulnerabilities. Ensuring URLs use HTTPS helps protect sensitive information by encrypting the communication channel.

To comply with this rule, always use HTTPS URLs when making network calls or referencing external resources. For example, instead of String url = 'http://example.com/api';, use String url = 'https://example.com/api';. Additionally, review and update any hardcoded URLs in your codebase to ensure they use HTTPS to maintain secure communication standards.

Non-Compliant Code Examples

public class AccountHelper {

    public void foo() {
        String foo = 'http://subdomain.salesforce.com/something';
    }
}

Compliant Code Examples

public class AccountHelper {

    public void foo() {
        String foo = 'https://subdomain.salesforce.com/something';
        String sanitizedUrl = url.replace('http://', 'https://');
    }
}

Seamless integrations. Try Datadog Code Security

Datadog Code Security