Skip to content
Mustry Solutionsiglint

SEC004: insecure-url

Plain http:// URL in an HTTP binding or system.net call
Code SEC004
Name insecure-url
Category Security (SEC)
Default severity info
Enabled by default yes
Fix available no
ign-lint equivalent none

What it does

Section titled “What it does”

Reports literal http:// URLs:

  • in the request.url of HTTP bindings;
  • passed as the URL of system.net.httpGet, httpPost, httpPut, httpDelete and openURL (first argument or url keyword);
  • passed to the request methods (get, post, put, delete, patch, head, options, trace, their Async forms, and request) of a client made by system.net.httpClient(), called directly or through a variable holding the client.

The functions are recognised through imports and aliases. The URL is a string literal, a name whose single reaching assignment is a literal, or text built with +, % or .format(...) that starts with such a literal. Only URLs whose literal part includes the host are reported ("http://" + host is not).

Loopback hosts are not reported: localhost, 127.0.0.0/8 and [::1]. Traffic to them does not leave the machine.

Why is this bad?

Section titled “Why is this bad?”

Plain HTTP sends the request, its headers (including credentials and session tokens) and the response unencrypted and unauthenticated over the network. Anyone on the path can read or change them. Use https://; for a device without TLS, keep it on an isolated network and document why.

Example

Section titled “Example”
client = system.net.httpClient()
response = client.get("http://erp.example.com/api/orders")

Use instead:

client = system.net.httpClient()
response = client.get("https://erp.example.com/api/orders")

Generated from the rule metadata by iglint generate-docs; iglint rule SEC004 prints the same page in the terminal. Source: docs/rules/SEC004.md.