The product provides or relies on use of HTTP communications when HTTPS is available.

Because HTTP communications are not encrypted, HTTP is subject to various attacks against confidentiality, integrity, and authenticity. However, unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption.

Primary

Resultant

Architecture and Design
The product might be designed in a way that assumes that HTTP will be used, e.g., by excluding considerations of encrypted communications between client and server.

Requirements
Product requirements might not include encrypted communications, which could make it easier for designers and developers to choose HTTP.

Implementation
Developers might choose to use unencrypted protocols such as HTTP because they would not require development of additional mechanisms to support encryption, e.g., key or certificate management.

Implementation
When generating content that references web sites such as email messages, ensure that the https:// prefix is included. If a domain name is presented without such a prefix, then clients might automatically treat the link as if it had an "http" prefix. For example, referencing a domain like "mysite.example.com" could cause it to be treated like "http://mysite.example.com", thereby sending unencrypted HTTP requests.

Operation
Designers might assume that the responsibility for encrypted communications might belong to operators and/or network administrators.

Confidentiality
Integrity
Read Application Data
Modify Application Data
High
HTTP can be subjected to attacks against confidentiality (by reading cleartext packets); integrity (by modifying sessions); and authenticity (by compromising servers and/or clients using cache poisoning, phishing, or other attacks that enable attackers to spoof a legitimate entity in the communication channel).

Architecture and Design
Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].

Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.

Implementation
Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.

Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2025-03-28
4.17
2025-04-03

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Michal Biesiada
2023-02-08
4.17
2025-04-03
suggested that CWE include "lack of HTTPS forcing" and "using HTTP instead of HTTPS with email and other content," and contributed references