Security Vulnerability: Insecure Data Transport (Medium)
Description
NEXRAD weather overlay tiles are loaded from http://mesonet.agron.iastate.edu/ using plain HTTP. This allows man-in-the-middle attacks to manipulate weather data displayed on the map.
Location
public_html/layers.js:174
Impact
- An attacker on the network path can modify weather radar data
- Could hide or fabricate weather conditions shown to users
- Leaks user access patterns to passive eavesdroppers
Suggested Fix
Change the tile URL to use HTTPS:
// Before
http://mesonet{1-3}.agron.iastate.edu/...
// After
https://mesonet.agron.iastate.edu/...Note
The mesonet server supports HTTPS. The subdomain-based load balancing (mesonet1, mesonet2, mesonet3) may not be needed with HTTPS as connection reuse is more effective.
Security Vulnerability: Insecure Data Transport (Medium)
Description
NEXRAD weather overlay tiles are loaded from
http://mesonet.agron.iastate.edu/using plain HTTP. This allows man-in-the-middle attacks to manipulate weather data displayed on the map.Location
public_html/layers.js:174Impact
Suggested Fix
Change the tile URL to use HTTPS:
Note
The mesonet server supports HTTPS. The subdomain-based load balancing (
mesonet1,mesonet2,mesonet3) may not be needed with HTTPS as connection reuse is more effective.