Azure App Service Web app doesn't use HTTP 2.0 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_18
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	54957a87-ae1f-4776-a656-7a274498b153

Impact

Periodically, new versions of HTTP are released to address security flaws and include additional functionality. HTTP 2.0 has additional performance improvements on the head-of-line blocking problem of the older HTTP version, header compression, and prioritization of requests. HTTP 2.0 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own more efficient mechanisms for data streaming. We recommend you use the latest HTTP version for web apps and take advantage of any security fixes and new functionalities featured. With each software installation you can determine if a given update meets your organization's requirements. Organizations should verify the compatibility and support provided for any additional software, assessing the current version against the update revision being considered.

How to Fix

Resource: azurerm_app_service

• Arguments: http2_enabled [source,go]

---

resource "azurerm_app_service" "example" { ...

• site_config {
• http2_enabled = true } }

---