The application calls the system_net_http_dll.System.Net.Http.HttpClient.PostAsync() function, which will result in data being transferred out of the application (via the network or another medium)

Code-1

using (var httpClient = new HttpClient())

      {

        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

        //-- Attach the id token. Session token will not work for this endpoint, because session token does not have application id claim.

        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", sessionToken);

        string getApplicationsForUserApiEndPoint = string.Format("{0}{1}?sourceApplicationId={2}", testUrl.TrimEnd('/'), APPLICATIONS_FOR_USER_API_PATH, applicationId);

        httpClient.BaseAddress = new Uri(getApplicationsForUserApiEndPoint.ToString());

        var userApplicationsResponse = await httpClient.GetAsync("");

        if (userApplicationsResponse.IsSuccessStatusCode)

        {

          var userApplicationsResponseContent = await userApplicationsResponse.Content.ReadAsStringAsync();

          if (!string.IsNullOrEmpty(userApplicationsResponseContent))

          {

            userApplicationModelList = JsonConvert.DeserializeObject<List<UserApplicationModel>>(userApplicationsResponseContent);

            if (userApplicationModelList == null || !userApplicationModelList.Any())

            {

              LogManager.TEST.ErrorLogFormat("TESTHelper:GetApplicationsForUser() - TEST did not return any application for Employee Id {0}.", loggedInEmployeeId);

            }

          }

        }

        else

        {

          LogManager.TEST.ErrorLogFormat("TESTHelper:GetApplicationsForUser() - TEST returned a status of '{0}' while trying to get the applications for Employee Id {1}.", userApplicationsResponse.StatusCode, loggedInEmployeeId);

        }

      }

Code-2

using (var client = new HttpClient())

        {

          ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;

          client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

          client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

          ActionTrackerModel actionTrackerModel = new ActionTrackerModel();

          actionTrackerModel.ActionCategory = (int)category;

          actionTrackerModel.EventDateTime = DateTime.UtcNow;

          actionTrackerModel.UserId = UserID;

          actionTrackerModel.Message = LogMessage;

          List<ActionTrackerModel> input = new List<ActionTrackerModel>();

          input.Add(actionTrackerModel);

          _loger.DebugFormat(HttpUtility.HtmlEncode(String.Format("parameters are : ActionCategory = {0} , EventDateTime = {1} , UserId = {2} , Message = {3}", ((int)category).ToString(), DateTime.UtcNow.ToString(), UserID.ToString(), LogMessage.ToString())).Replace("&amp;", "&"));

          var content = new StringContent(JsonConvert.SerializeObject(input), Encoding.UTF8, "application/json");

          string url = ConfigurationManager.AppSettings["HAPLogUrl"].ToString();

          client.BaseAddress = new Uri(url.ToString());

          var httpResponse = client.PostAsync("", content);

          var response = httpResponse.Result;

          _loger.DebugFormat(HttpUtility.HtmlEncode(String.Format("HTTP Response & Response result = {0} and {1}", httpResponse.ToString(), response.ToString())).Replace("&amp;", "&"));

          if (response.StatusCode != HttpStatusCode.OK)

          {

            _loger.Error("Unable to log to Hap portal. Status Code " + response.StatusCode.ToString());

          }

          else

          {

            _loger.Debug("Successfully logged to kenisis and the response code is " + response.StatusCode.ToString());

          }

        }

The issue is this 2 code - var userApplicationsResponse = await httpClient.GetAsync(""); & var httpResponse = client.PostAsync("", content); which is causing the information leakage issue. Kindly let us know about this issue to fix CWE 201 & 209 information leakage ASAP.