Back to Checks
azure

App Service web app has HTTP/2.0 enabled

app_ensure_using_http20
Service: appSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.web/sites

Azure App Service web apps are evaluated for HTTP/2 support via the http20_enabled configuration, indicating whether the site serves traffic using the HTTP/2 protocol

Prowler logoProwlerprowler-provider-azure

Risk

Without HTTP/2, apps remain on HTTP/1.1, increasing connection overhead and head-of-line blocking, which can reduce availability under load. Inefficient use of TLS sessions raises DoS susceptibility and degrades user experience, impacting service reliability

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_using_http20

Recommendation

Enable HTTP/2 (http20_enabled=true) to use a modern, efficient transport.

  • Enforce HTTPS Only and a strong minimum TLS version for defense-in-depth
  • Validate app/library compatibility before rollout
  • Monitor performance and errors post-change; deploy gradually

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --http20-enabled true

Terraform

# Enable HTTP/2.0 for an App Service (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<LOCATION>"
  resource_group_name = "<example_resource_group>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    http2_enabled = true # Critical: enables HTTP/2.0
  }
}

NativeIaC

// Enable HTTP/2.0 on an existing App Service web app
resource webConfig 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '<example_resource_name>/web'
  properties: {
    http20Enabled: true // Critical: enables HTTP/2.0 for the app
  }
}

Other

1Sign in to the Azure portal and go to App Services
2Select your web app
3Navigate to Settings > Configuration > General settings
4Set HTTP version to 2.0
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_using_http20(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"HTTP/2.0 is not enabled for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                if app.configurations and getattr(
                    app.configurations, "http20_enabled", False
                ):
                    report.status = "PASS"
                    report.status_extended = f"HTTP/2.0 is enabled for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References