Usage of insecure HTTP connection

• Rule ID: python_lang_insecure_http
• Languages: python
• Source: insecure_http.yml

Description

Your application is at risk when it connects to APIs using insecure HTTP connections. This vulnerability occurs because HTTP lacks encryption, making data susceptible to interception and alteration. Always verify that your application exclusively uses HTTPS connections for enhanced security.

Remediations

• Do not initiate connections using unsecured HTTP. This exposes your data to potential interception and manipulation.

  urllib.request.urlopen("http://insecure-api.com") # unsafe

• Do ensure all connections are made through HTTPS to encrypt data and protect against eavesdropping and tampering.

  urllib.request.urlopen("https://secure-api.com")

References

• OWASP insecure transport

Associated CWE

• CWE-319: Cleartext Transmission of Sensitive Information

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=python_lang_insecure_http

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=python_lang_insecure_http