Back to Checks
azure

App Service web app redirects HTTP to HTTPS

app_ensure_http_is_redirected_to_https
Service: appSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.web/sites

Azure App Service web apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled. This evaluation identifies apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.

Prowler logoProwlerprowler-provider-azure

Risk

Leaving HTTP accessible enables man-in-the-middle interception, credential and cookie theft, and response tampering. This undermines confidentiality and integrity, and can lead to session hijacking or downgrade attacks that bypass TLS.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_http_is_redirected_to_https

Recommendation

Enforce HTTPS-only for all apps.

  • Use trusted certificates and require TLS 1.2 or later
  • Enable HSTS to prevent downgrade/mixed-content
  • Redirect legacy http links to https
  • Minimize HTTP exposure via WAF/CDN or private access Apply defense in depth to protect data in transit.

Remediation

CLI

az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set httpsOnly=true

Terraform

# Enforce HTTPS-only on an App Service
resource "azurerm_windows_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  service_plan_id     = "<example_resource_id>"

  https_only = true # Critical: redirects HTTP to HTTPS
}

NativeIaC

// Enable HTTPS-only redirect on an existing App Service
resource app 'Microsoft.Web/sites@2022-09-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    httpsOnly: true  // Critical: forces redirect from HTTP to HTTPS
  }
}

Other

1Sign in to the Azure portal and go to App Services
2Select your web app
3Go to TLS/SSL settings and set HTTPS Only to On
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_http_is_redirected_to_https(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"HTTP is redirected to HTTPS for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                if not app.https_only:
                    report.status = "FAIL"
                    report.status_extended = f"HTTP is not redirected to HTTPS for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References