Insecure endpoint callouts
Why is this an issue?
Using HTTP instead of HTTPS for external callouts exposes data to interception through man-in-the-middle attacks. Sensitive information such as authentication tokens, API keys, and business data can be captured by attackers monitoring network traffic.
Examples
Example of incorrect code:
Http http = new Http();
HttpRequest request = new HttpRequest();
request.setEndpoint('http://api.example.com/data');
request.setMethod('GET');
HttpResponse response = http.send(request);
Example of correct code using HTTPS:
Http http = new Http();
HttpRequest request = new HttpRequest();
request.setEndpoint('https://api.example.com/data');
request.setMethod('GET');
HttpResponse response = http.send(request);
Example of correct code using Named Credentials (recommended):
Http http = new Http();
HttpRequest request = new HttpRequest();
request.setEndpoint('callout:ExampleAPI/data');
request.setMethod('GET');
HttpResponse response = http.send(request);
Example of incorrect Remote Site Setting:
<RemoteSiteSetting>
<fullName>ExampleAPI</fullName>
<url>http://api.example.com</url>
<isActive>true</isActive>
</RemoteSiteSetting>
Example of correct Remote Site Setting:
<RemoteSiteSetting>
<fullName>ExampleAPI</fullName>
<url>https://api.example.com</url>
<isActive>true</isActive>
</RemoteSiteSetting>
How can I fix violations?
Use HTTPS endpoints: Change all endpoint URLs from
http://tohttps://.Update Remote Site Settings: Ensure all Remote Site Settings use HTTPS URLs. This rule supports autofix for Remote Site Settings, which updates the URL to HTTPS and sets
disableProtocolSecuritytofalse.Use Named Credentials: Named Credentials enforce secure connections and simplify endpoint management.
Resources