Rule Definition
Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. Typically, HTTPS servers do a basic TLS handshake and accept any client connection as long as a compatible cipher suite can be found. However, the server can be configured to challenge the client with a CertificateRequest during the TLS handshake. This forces the client to present a valid certificate before the negotiation can continue.

Remediation
Ensure you have enabled secure HTTPS protocol and loaded keys for establishing secure HTTPS connection

Violation Code Sample

// Insecure HTTP connection 
import * as http from "http"
http.createServer(app).listen(config.port, function() { 
 console.log("Express http server listening on port " + config.port); 
 });

// or HTTP2

import * as http2 from "http2"
http2.createServer(app).listen(config.port, function() { 
 console.log("Express http server listening on port " + config.port); 
 });

Fixed Code Sample

// Use secure HTTPS protocol 
// Load keys for establishing secure HTTPS connection 
import * as fs from "fs"
import * as https from "https"
import * as path from "path"
var httpsOptions = { 
 key: fs.readFileSync(path.resolve(__dirname, "./artifacts/cert/server.key")), // setting Keys and Certificates
 cert: fs.readFileSync(path.resolve(__dirname, "./artifacts/cert/server.crt")) 
}; 
https.createServer(httpsOptions, app).listen(config.port, function() { 
 console.log("Express https server listening on port " + config.port); 
 });

// or using createSecureServer with HTTP2
import * as http2 from "http2"

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem')
};

// Create a secure HTTP/2 server
const server = http2.createSecureServer(options);
server.listen(config.port, function() { 
 console.log("Express http server listening on port " + config.port); 
 });

https://expressjs.com/en/advanced/best-practice-security.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure