Microsoft AzureOverview
Periodically, newer HTTP versions are released, either due to security flaws or to include additional functionality. Apps should use the latest HTTP version to take advantage of any security fixes and/or new functionalities of the newer version.
Rationale
Newer versions may contain security enhancements and additional functionality. Using the latest version is recommended for enhancements and new capabilities. Organizations must determine if a given update meets their requirements with each software installation. They must also verify the compatibility and support of any additional software against the selected update revision.
HTTP 2.0 has additional performance improvements on the old HTTP version's head-of-line blocking problem, header compression, and request prioritization. HTTP 2.0 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming.
Impact
Most modern browsers support HTTP 2.0 protocol over TLS only, while non-encrypted traffic uses HTTP 1.1. To ensure that client browsers connect to your app with HTTP/2, either buy an App Service Certificate for your app's custom domain or bind a third-party certificate.
Remediation guidance
Remediate from Azure Portal
- Open the web app using the
Open in Azurebutton. - Under
Settingsection, Click onConfiguration - Set
HTTP versionto2.0underGeneral settings
NOTE: Most modern browsers support HTTP 2.0 protocol over TLS only, while non-encrypted traffic continues to use HTTP 1.1. To ensure that client browsers connect to your app with HTTP/2, either buy an App Service Certificate for your app's custom domain or bind a third-party certificate.
Remediate from Azure CLI
To set HTTP 2.0 version for an existing app, run the following command:
az webapp config set --resource-group --name --http20-enabled true
Remediate from PowerShell
To enable HTTP 2.0 version support, run the following command:
Set-AzWebApp -ResourceGroupName -Name -Http20Enabled $true
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure App Service apps without HTTP 2.0
Connectors
Covered asset types
Expected check: eq []
{
sites(where: { siteConfig: { http20Enabled: false } }) {
...AssetFragment
}
}
