Why is this an issue?
The API server in cmd/api/main.go:87-88 uses ListenAndServe() (HTTP) instead of ListenAndServeTLS(). All API traffic including credentials is transmitted in plaintext.
What is causing it?
StartHTTPServer: func(s *http.Server) error {
return s.ListenAndServe()
},How can it be solved?
Add TLS certificate configuration and use ListenAndServeTLS(certFile, keyFile, handler).
Category
Severity
Why is this an issue?
The API server in
cmd/api/main.go:87-88usesListenAndServe()(HTTP) instead ofListenAndServeTLS(). All API traffic including credentials is transmitted in plaintext.What is causing it?
How can it be solved?
Add TLS certificate configuration and use
ListenAndServeTLS(certFile, keyFile, handler).Category
Severity