Sensitive information sent insecurely
Description
Sensitive information, such as session identifiers, is sent through channels or methods that do not guarantee its confidentiality, including unencrypted connections or URL query parameters.
Impact
Compromise sensitive information transmitted or exposed through an insecure channel.
Recommendation
- Transmit sensitive information only over encrypted channels, such as HTTPS with TLS 1.2 or higher. - Do not place session identifiers or other sensitive data in URL query parameters; use the request body, secure cookies, or headers instead, since encryption alone does not prevent their exposure.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
⏱️ 60 minutes.