Detections
Analytics

1.80 (L1) Ensure 'Control where security restrictions on insecure origins apply' is set to 'Disabled'

Information

This policy setting allows for a specified list of origins (URLs) or hostname patterns (like '*.contoso.com') for which security restrictions on insecure origins don't apply.

Allowed origins for legacy applications that can't deploy TLS or set up a staging server for internal web development so that developers can test features requiring secure contexts without having to deploy TLS on the staging server. This policy also prevents the origin from being labeled Not Secure in the omnibox.

The recommended state for this setting is: Disabled.

Insecure contexts should always be labeled as insecure.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled :

Microsoft Edge\Control where security restrictions on insecure origins apply

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/24642

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Windows

Control ID: 395fa621164402662aa4e0d170687659de0eef80e58c8dc4920e27f00e63f83a