ASVS 5.0 V12.2.1 requires TLS on every connection between a client and your external facing HTTP services, with no way to fall back to unencrypted communication. This is Level 1, so it applies to every application.
A redirect from http to https is a start, not the finish. The first plain request has already left the browser, cookies and all, unless you take extra steps.
Why it matters
Anyone on the network path of a plain HTTP request can read it, change it or inject script into the response. Session cookies without the Secure flag ride along on that first request. An attacker who strips the redirect (sslstrip style) keeps the victim on HTTP indefinitely.
How to implement it
Layer the controls.
- Serve the application only over TLS. Close port 80, or answer it with a redirect and nothing else.
- Send HSTS so browsers refuse plain HTTP in future visits.
- Mark session cookies Secure.
- Never offer an http:// alternative on APIs. Return an error rather than redirecting API clients, since a client that follows a redirect has already sent its credentials.
nginx:
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}
Express with secure cookies:
app.set("trust proxy", 1);
app.use(session({
secret: process.env.SESSION_SECRET,
cookie: { secure: true, httpOnly: true, sameSite: "lax" },
}));
Start HSTS with a short max-age while you confirm every subdomain works, then raise it. Add preload only when you are certain, because it is hard to undo.
How to test it
curl -sI http://example.com/ | head -n 5
curl -sI https://example.com/ | grep -i strict-transport
Expect a 301 to the https URL and an HSTS header on the https response. Then check every host and port in your inventory, not only the main site: api, admin, staging, webhook receivers. A dynamic scan finds the forgotten ones.
Click through it at your own pace, or open it full screen.
Common mistakes
- Redirecting API calls instead of rejecting them.
- Mixed content: an https page that loads a script or image from http.
- TLS terminated at the load balancer, then the app generates http:// absolute URLs because it does not trust the forwarded protocol header.
- HSTS set on the main domain but not on the API host.
Try it yourself
Make a list of every hostname your product exposes: marketing site, app, API, admin, status page, webhook receivers and any staging or preview environments that face the internet. For each one, run the two curl checks above and record the result in a small table with three columns: plain HTTP response, HSTS header present, cookies flagged Secure.
Next, search your frontend code for hard coded http:// URLs and add a Content Security Policy directive such as upgrade-insecure-requests while you clean them up. Finally, try an API client against the plain HTTP port and confirm it gets an error, not a redirect.
Rows with a gap are your work list. Most teams find at least one forgotten host.
Quick check
Is a 301 redirect from http to https enough for V12.2.1?
It helps but is not enough alone. Add HSTS, Secure cookies and reject plain HTTP on APIs.
Which level is this?
Level 1.
