Use `https` protocol over `http`

문서 > 코드 분석 > Static Analysis Rules > Use `https` protocol over `http`

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: javascript-express/https-protocol-missing

Language: JavaScript

Severity: Warning

Category: Security

CWE: 693

Description

Per Express documentation:

If your app deals with or transmits sensitive data, use Transport Layer Security (TLS) to secure the connection and the data. This technology encrypts data before it is sent from the client to the server, thus preventing some common (and easy) hacks.

This rule will detect the usage of non https.createServer() usage.

Non-Compliant Code Examples

var http = require('http');
var express = require('express');
var app = express();

var httpServer = http.createServer(app)
httpServer.listen(8080);

Compliant Code Examples

var https = require('https');
var express = require('express');
var app = express();

var httpsServer = https.createServer(app)
httpsServer.listen(8080);