HTTP request used instead of HTTPS

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST Rules > HTTP request used instead of HTTPS

Metadata

ID: rust-security/http-insecure-request

Language: Rust

Severity: Warning

Category: Security

CWE: 319

Related CWEs:

1428

Description

Making HTTP requests instead of HTTPS transmits data in cleartext over the network, exposing credentials, tokens, and payloads to any passive observer on the network path. Use https:// URLs unconditionally for external connections.

Learn More

CWE-319: Cleartext Transmission of Sensitive Information

Non-Compliant Code Examples

use reqwest::Client;

async fn bad_calls() -> reqwest::Result<()> {
    let client = Client::new();
    let _ = client.get("http://api.example.com").send().await?;
    let _ = client.post("http://api.example.com/users").send().await?;

    // Module-level call
    let _ = reqwest::get("http://api.example.com").await?;
    let _ = reqwest::get(r"http://api.example.com").await?;

    // ureq call
    let _ = ureq::get("http://api.example.com").call()?;
    Ok(())
}

Compliant Code Examples

use reqwest::Client;

async fn ok_calls() -> reqwest::Result<()> {
    let client = Client::new();
    let _ = client.get("https://api.example.com").send().await?;
    let _ = client.post("https://api.example.com/users").send().await?;
    let _ = reqwest::get("https://api.example.com").await?;

    // Loopback addresses are allowed
    let _ = client.get("http://localhost:8080").send().await?;
    let _ = client.get("http://127.0.0.1:3000/health").send().await?;
    let _ = client.get("http://[::1]/status").send().await?;
    Ok(())
}