Azure Function App doesn't use HTTP 2.0 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_67
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	3ac6e13f-bee1-48cc-b1a9-33056c1c6654

Impact

This rule identifies Azure Function App which doesn't use HTTP 2.0. HTTP 2.0 has additional performance improvements on the head-of-line blocking problem of the old HTTP version, header compression, and prioritization of requests. HTTP 2.0 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming.

How to Fix

Resource: azurerm_function_app

• Arguments: site_config.http2_enabled [source,go]

---

resource "azurerm_function_app" "example" { ...

• site_config {
• http2_enabled = true } }

---