Overview

In 2024, Bazaarvoice began efforts to improve the security and performance of the APIs used by our clients. The initial effort focused on preventing the use of HTTP and deprecating older, weak ciphers for HTTPS calls. To address the use of HTTP, Bazaarvoice began enforcing HTTPS calls starting on Aug 30, 2024. Any HTTP calls made after that date were returned back to the client with a 3XX response containing redirects with an amended URL containing HTTPS.

While these efforts ensured all API calls were being made using HTTPS with strong ciphers, the use of redirects was meant to be a short term fix allowing clients sufficient time to make changes needed to initiate calls using HTTPS.

❗️

Bazaarvoice will stop supporting redirects for any HTTP API call traffic later this year. Exact date will be communicated directly with impacted clients via email.

As such, Bazaarvoice is moving forward with efforts to halt the use of redirects for calls made using HTTP. This is being done to ensure clients have the most secure and performant API access to the products being used.

Security Risks - Redirects

1. Redirects can expose sensitive information in query parameters, making them visible in logs or to intermediaries.
2. Attackers could exploit open redirect vulnerabilities, tricking users into following malicious links.
3. If HTTPS is not enforced, an HTTP-to-HTTPS redirect could allow a man-in-the-middle (MITM) attack before the secure connection is established.

Performance Impact

1. Each redirect adds additional HTTP round trips, increasing response times and slowing down application performance.
2. Clients must follow the redirect, leading to increased latency, which is particularly harmful for real-time applications or high-throughput APIs.

HTTPS Requirement and FAQs

❗️

The continued use of redirects for HTTP calls poses risks to both the security and performance of API calls serving Bazaarvoice products to clients.

What to do?

👍

Secured way is the right way! Enforce HTTPS.

Clients should review all code being used to initiate API calls to Bazaarvoice products and identify any instances where API calls are being made using HTTP. Once identified, the code should be changed to make HTTPS calls only.

How do I know if I’m using HTTP?

📘

When in doubt, reach out to Bazaarvoice Support

Bazaarvoice has collected a list of clients who have initiated API call using HTTP over the last 90 days. Please reach out to support and raise a query for more details on usage.

What if I don’t make any API calls using HTTP?

👍

Clients using HTTPS to initiate API calls will NOT be impacted by this change.