CWE-1428 Reliance on HTTP instead of HTTPS

The product provides or relies on use of HTTP communications when HTTPS is available.

• Confidentiality, Integrity: Read Application Data, Modify Application Data — HTTP can be subjected to attacks against confidentiality (by reading cleartext packets); integrity (by modifying sessions); and authenticity (by compromising servers and/or clients using cache poisoning, phishing, or other attacks that enable attackers to spoof a legitimate entity in the communication channel).

• [Architecture and Design] Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464]. • [Implementation] Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications. • [Implementation, Operation] Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS. • [Operation] If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).