---
title: Avoid cleartext HTTP URLs
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid cleartext HTTP URLs
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid cleartext HTTP URLs

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `dart-security/no-http-url`

**Language:** Dart

**Severity:** Warning

**Category:** Security

**CWE**: [319](https://cwe.mitre.org/data/definitions/319.html)

**Related CWEs**:

- [1428](https://cwe.mitre.org/data/definitions/1428.html)

## Description{% #description %}

A string literal starting with `http://` transmits data in cleartext, exposing it to eavesdropping and man-in-the-middle attacks. Replace `http://` with `https://` to enforce TLS-encrypted transport for all network communication, including API endpoints, webhooks, and any third-party service URLs referenced in the code.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```dart
void main() {
  final apiUrl = 'http://api.example.com/data';
  final webhookUrl = "http://hooks.example.com/event";
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```dart
void main() {
  final url = 'https://api.example.com/data';
  final webhook = "https://hooks.example.com/event";
  final local1 = 'http://localhost:8080/api';
  final local2 = 'http://127.0.0.1/health';
  final local3 = 'http://[::1]/test';
  final logMsg = 'Log message http://api.example.com/data';
}
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}