Azure App Service Web app client certificate is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_17
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	b2b42ffc-6552-4e5c-a189-7f76e4adb53b

Impact

Client certificates allow the Web App to require a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled only an authenticated client with valid certificates can access the app.

How to Fix

Resource: azurerm_app_service

• Arguments: client_cert_enabled [source,go]

---

resource "azurerm_app_service" "example" { ...

• client_cert_enabled = true }

---