Require HTTPS Metadata False
JWT/OIDC middleware is configured with RequireHttpsMetadata = false, so token/metadata endpoints may be contacted over cleartext HTTP and are exposed to man-in-the-middle tampering of signing keys (CWE-319).
Standards mapping
- OWASP Top 10
- A02:2021 - Cryptographic Failures
- OWASP ASVS
- V9.2.1 (L2)
Vulnerable vs. safe
jwtOptions.RequireHttpsMetadata = false;jwtOptions.RequireHttpsMetadata = true;Why it matters & how to fix it
JWT/OIDC middleware is configured with RequireHttpsMetadata = false, so token/metadata endpoints may be contacted over cleartext HTTP and are exposed to man-in-the-middle tampering of signing keys (CWE-319). Leave RequireHttpsMetadata = true (the default) and serve authority metadata over HTTPS in all environments except isolated local development.
References
Rule ID integsec.csharp.insecure-config.require-https-metadata-false - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Insecure ConfigurationCORS Acao Wildcard Header
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard Origin
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard With Credentials
- JavaScript / TypeScript - Insecure ConfigurationCSRF Protection Disabled
- JavaScript / TypeScript - Insecure ConfigurationExpress Trust Proxy All
- JavaScript / TypeScript - Insecure ConfigurationExpress X Powered By Enabled