Remediating Authentication on Insecure Channel findings

This assessment looks for situations where a web application is requesting authentication from a user on an insecure channel. The following situations are considered:

• Web application is requesting credentials via the www-Authenticate header over an insecure non-HTTPS connection
• An authentication HTML form is being presented over an insecure non-HTTPS connection
• Password forms are requesting credentials on a site loaded with TLS Errors

Need to fix?

• Ensure all authentication forms and APIs use HTTPS with a valid, trusted certificate.
• Fix any TLS errors or certificate issues.

To verify it is fixed:

• Access the site and confirm authentication is only possible over HTTPS.
• Check the Bitsight Findings Table for a “GOOD” grade or remediated status.

What will I see in the Portal?

Finding Message: The web application is requesting credentials over an insecure non-HTTPS connection.

Possible Grades:

• Good: Weight = 0
• Warn: Password requested on site with "Obsolete connections settings" TLS error (Weight = 10).
• Bad: High-severity findings include: credentials requested via www-Authenticate header over non-HTTPS; password form over HTTP; or password form on a site with a "This site is missing a valid, trusted certificate" TLS error (Weight = 1000).