# CD-SEC-05 - Authentication and Secure Communication Failures

> Functionality-first defaults lead to disabled TLS validation, HTTP instead of HTTPS, hardcoded bearer tokens, and missing MFA.

- **Category**: Owasp Citizen Development
- **Subcategory**: top10
- **Canonical URL**: https://designpattern.fyi/owasp_citizen_development/cdsec05_authentication_communication_failures/

---

## Description
'**Intent**: Prevent functionality-first defaults that compromise authentication and secure communication.

**Context**: Functionality-first defaults lead to disabled TLS validation, HTTP instead of HTTPS, hardcoded bearer tokens, and missing MFA — because the citizen developer's goal is "make the connection work," and disabling a security check is often the fastest way to clear an error.

**Solution**: Restrict new production connections to authorized personnel. Implement platform-level scanning for non-compliant connections. Create pre-built "secure connection" templates so the easy path and the secure path are the same path. Enforce TLS and block HTTP-only endpoints at the platform/network layer. Require MFA for sensitive connections.'



## Use Cases
Use when configuring connections, APIs, or authentication in low-code/no-code platforms and AI development tools.





## Trade-offs


### Advantages

- Ensures secure communications

- Prevents hardcoded credentials

- Enforces security best practices

- Reduces misconfiguration risk




### Considerations & Drawbacks

- May require platform changes

- Template maintenance overhead

- Could slow development initially







---
**Reference**: [Original Source](https://owasp.org/www-project-citizen-development-top10-security-risks/)