Cleartext transmission of sensitive information
Description
The application was found setting `force_ssl` to `false`. This setting can expose the application to the risk of network interception of unencrypted traffic. Enabling `force_ssl` by setting `config.force_ssl = true` in the application's configuration, specifically within `config/environments/production.rb`, forces the use of HTTPS, encrypting data in transit and safeguarding against eavesdropping or data tampering.
Examples
Insecure Code
ruby
config.force_ssl = falseSecure Code
ruby
config.force_ssl = trueRemediation
Set `config.force_ssl` to `true` in the application's configuration.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0552 |
| Category | InsecureConfig |
| Severity | MEDIUM |
| CWE | CWE-319 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | ssl, https, encryption |
| OWASP | A3:2017-Sensitive Data Exposure, A04:2021-Insecure Design |