Cleartext HTTP traffic (ARCH2118)

Key python.security.cleartext-http · Severity warning · Category security · CWE CWE-319

Sending sensitive data over http:// lets the traffic travel the network in cleartext, readable by anyone in the path. All sensitive requests should be protected with TLS.

Incorrect

import requests

resp = requests.post("http://api.example.com/login",
                     json={"user": user, "password": pw})

Correct

import requests

resp = requests.post("https://api.example.com/login",
                     json={"user": user, "password": pw})

Fix

Call all sensitive endpoints over https:// and never disable TLS validation.