Description

Detects when an HTTP server is configured without enforcing HTTPS, allowing insecure HTTP connections. This creates a security risk since communication between clients and the server could be intercepted or modified by attackers due to lack of encryption.

Detection Strategy

• Check server configuration objects or initialization parameters for HTTP server creation

• Look for missing or disabled HTTPS/TLS configuration flags and settings

• Verify if the server allows unencrypted HTTP connections without redirecting to HTTPS

• Report when HTTP server configurations lack secure HTTPS enforcement

Vulnerable code example

{
  "name": "vulnerable-app",
  "version": "1.0.0",
  "scripts": {
    "start": "http-server -p 8080 -a localhost" // Vulnerable: Binding to localhost can allow unauthorized local network access
  }
}

✅ Secure code example

{
  "name": "secure-app",
  "version": "1.0.0",
  "scripts": {
    "start": "http-server -p 8080 --ssl --cors -C cert.pem -K key.pem", // Secure: Uses HTTPS and CORS headers for protection
    "start:local": "http-server -p 8080 -a 127.0.0.1 --ssl --cors" // Secure: Strictly local access with HTTPS
  }
}