id: https-to-http-redirect

info:
  name: HTTPS to HTTP redirect Misconfiguration
  author: kazet
  severity: info
  description: |
    Detects whether there is a redirect from https:// to http://
  metadata:
    max-request: 1
    verified: true
  tags: misconfig,http,https

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'startswith(tolower(location), "http://")'
          - 'startswith(tostring(BaseURL), "https://")'
          - '(status_code == 301 || status_code == 302 || status_code == 307)'
        condition: and
# digest: 4a0a0047304502206212deffff885bc2abd110b7921124764815e61844a28cf278f271f6d9753151022100861fee57cff6e033d3b77a48aa8a88595f5d7ea267d502b1aadf739e417f6608:922c64590222798bb761d5b6d8e72950