OWASPASVS 5.0 requirement
ASVS-V4.1.2 Only user-facing endpoints (intended for manual web-browser access) automatically redirect from http to https, while other services or…
- Standard
- OWASP ASVS 5.0
- Chapter
- V4 API and Web Service
- Section
- V4.1 Generic Web Service Security
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that only user-facing endpoints (intended for manual web-browser access) automatically redirect from HTTP to HTTPS, while other services or endpoints do not implement transparent redirects. This is to avoid a situation where a client is erroneously sending unencrypted HTTP requests, but since the requests are being automatically redirected to HTTPS, the leakage of sensitive data goes undiscovered.