Skip to content

AvoidUsingAllowUnencryptedAuthentication.md

Latest commit

 

History

History
74 lines (53 loc) · 2.42 KB

AvoidUsingAllowUnencryptedAuthentication.md

File metadata and controls

74 lines (53 loc) · 2.42 KB
Raw
description Avoid sending credentials and secrets over unencrypted connections
ms.date 07/21/2026
ms.topic reference
title AvoidUsingAllowUnencryptedAuthentication

AvoidUsingAllowUnencryptedAuthentication

Severity Level: Warning

Default state: Always enabled

Description

This rule detects the AllowUnencryptedAuthentication parameter used with Invoke-WebRequest and Invoke-RestMethod cmdlets. When AllowUnencryptedAuthentication is used, it permits credentials and secrets to be transmitted over unencrypted connections, creating a security risk.

Avoid using this parameter unless you must maintain compatibility with legacy systems that require unencrypted authentication.

To learn more, see Invoke-WebRequest and Invoke-RestMethod.

Example

Noncompliant

Invoke-WebRequest foo -AllowUnencryptedAuthentication

Compliant

Invoke-WebRequest foo

Configure rule

This rule is always enabled and isn't configurable. Use one of the following methods to avoid using this rule:

  • Create a custom rule configuration file to include only the rules you want or exclude the rules you don't want.
  • Add the appropriate rule suppression attributes to your code to suppress the rule for specific code blocks. For more information, see the Suppressing rules section of Using PSScriptAnalyzer.

Suppression

As with other rules, you can suppress this rule by adding a suppression attribute to the param block of a function or script. An empty string as the second argument suppresses every violation of the rule in that scope.

[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingAllowUnencryptedAuthentication', '')]

To suppress the rule for a single command, pass the command name as it appears in the call as the second argument. The name isn't case sensitive, but it must match what's written in the script, so a call made through an alias needs the alias name.

function Test-Script {
    [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingAllowUnencryptedAuthentication', 'Invoke-WebRequest')]
    param()

    Invoke-WebRequest foo -AllowUnencryptedAuthentication
}