COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1428

Reliance on HTTP instead of HTTPS

The product provides or relies on use of HTTP communications when HTTPS is available.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product provides or relies on use of HTTP communications when HTTPS is available.

Extended description

Because HTTP communications are not encrypted, HTTP is subject to various attacks against confidentiality, integrity, and authenticity. However, unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

The product might be designed in a way that assumes that HTTP will be used, e.g., by excluding considerations of encrypted communications between client and server.

Lifecycle phase

Requirements

Product requirements might not include encrypted communications, which could make it easier for designers and developers to choose HTTP.

Lifecycle phase

Implementation

Developers might choose to use unencrypted protocols such as HTTP because they would not require development of additional mechanisms to support encryption, e.g., key or certificate management.

Lifecycle phase

Implementation

When generating content that references web sites such as email messages, ensure that the https:// prefix is included. If a domain name is presented without such a prefix, then clients might automatically treat the link as if it had an "http" prefix. For example, referencing a domain like "mysite.example.com" could cause it to be treated like "http://mysite.example.com", thereby sending unencrypted HTTP requests.

Lifecycle phase

Operation

Designers might assume that the responsibility for encrypted communications might belong to operators and/or network administrators.

Risk

What does successful exploitation lead to?

Read Application DataModify Application Data

Affected security scopes: Confidentiality, Integrity

HTTP can be subjected to attacks against confidentiality (by reading cleartext packets); integrity (by modifying sessions); and authenticity (by compromising servers and/or clients using cache poisoning, phishing, or other attacks that enable attackers to spoof a legitimate entity in the communication channel).

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].

Implementation

Implementation-phase defence

Detail
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.

Implementation · Operation

Defence to apply across several lifecycle phases

Detail
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.

Operation

Operational defence

Detail
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).