Cleartext HTTP (ARCH4118)

Key java.security.cleartext-http · Severity warning · Category security · CWE CWE-319

Carrying sensitive data over http:// exposes traffic in cleartext to network eavesdroppers. Use TLS (https://) for all sensitive calls.

Incorrect

String url = "http://api.example.com/login";
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .POST(BodyPublishers.ofString(credentials))
    .build();

Correct

String url = "https://api.example.com/login";
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(url))
    .POST(BodyPublishers.ofString(credentials))
    .build();

Fix

Use https:// instead of http:// for sensitive endpoints and keep TLS validation enabled.