Issue with bicep and httpsOnly/minimalTls #7491

chielboogaard · 2025-06-11T15:21:32Z

chielboogaard
Jun 11, 2025

Hi all,

I'm currently testing if Kics would work in our workflow. But I'm finding that the checks:

488847ff-6031-487c-bf42-98fd6ac5c9a0: Website Not Forcing HTTPS
b5c851d5-00f1-43dc-a8de-3218fd6f71be: Web App Not Using TLS Last Version
70111098-7f85-48f0-b1b4-e4261cf5f61b: Website with 'Http20Enabled' Disabled

Are always flagged.

I have the following resource in bicep:

resource _webApplication 'Microsoft.Web/sites@2024-11-01' = {
  dependsOn: []
  name: '${NameInfix}WA-${Webapp.name}-${Webapp.index}'
  location: Location
  tags: isSiteshield ? union(Tags, { SiteShield: siteShieldMapAlias }) : Tags
  kind: Webapp.kind
  properties: {
    serverFarmId: _appServicePlan.id
    httpsOnly: true
    reserved: Webapp.asp.os == 'linux' ? true : Webapp.asp.os == 'windows' ? false : false
    siteConfig: {
      http20Enabled: true
      minTlsVersion: '1.2'
    }
    virtualNetworkSubnetId: _virtualNetwork::_subnet.id
  }
}

does not matter what I do, the 3 above are always flagged.

anyone an idea what I'm doing wrong or what is going on here?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Issue with bicep and httpsOnly/minimalTls #7491

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Issue with bicep and httpsOnly/minimalTls #7491

Uh oh!

chielboogaard Jun 11, 2025

Replies: 0 comments

chielboogaard
Jun 11, 2025