Microsoft AzureOverview
Azure Function Apps should redirect or reject plain HTTP traffic so function invocations, headers, tokens, and payloads are protected in transit. HTTP support increases the chance of credential exposure and downgrade mistakes, especially for webhook-style endpoints.
Require HTTPS and combine it with a modern minimum TLS version for all Function Apps.
Remediation guidance
Remediation
Enable HTTPS-only access on the Function App.
Azure CLI
az functionapp update \
--resource-group {{asset.azureResourceGroup}} \
--name {{asset.name}} \
--set httpsOnly=true
Validate the setting:
az functionapp show \
--resource-group {{asset.azureResourceGroup}} \
--name {{asset.name}} \
--query '{name:name,httpsOnly:httpsOnly}'
References
- https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts
- https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https
Query logic
These are the stored checks tied to this control.
Azure Function Apps without HTTPS only
Connectors
Microsoft Azure
Covered asset types
FunctionApp
Expected check: eq []
{
functionApps(
where: {
httpsOnly: { eq: false }
}
) {
...AssetFragment
}
}
