Cleartext HTTP (ARCH7118)

Key php.security.cleartext-http · Severity warning · Category security · CWE CWE-319

Sending sensitive data over http:// exposes credentials and tokens to attackers eavesdropping on the network. All sensitive traffic must be encrypted with TLS.

Incorrect

<?php
$response = $client->post('http://api.example.com/login', [
    'json' => ['user' => $user, 'password' => $password],
]);

Correct

<?php
$response = $client->post('https://api.example.com/login', [
    'json' => ['user' => $user, 'password' => $password],
]);

Fix

Use https:// for every endpoint and never disable TLS certificate validation.