PMD Security error - Apex Suggest Using Named Cred

Question

I'm getting ApexSuggestUsingNamedCred **Suggest named credentials for authentication** in Below Code.

 Blob headerValue = Blob.valueOf(username + ':' + password);
        String authorizationHeader = 'Basic ' + EncodingUtil.base64Encode(headerValue);
        system.debug('Encoder Value' + EncodingUtil.base64Encode(headerValue));
        http http = new http();
        httpRequest request = new httpRequest();
        request.setMethod('POST');
        request.setEndpoint(endpoint);
        request.setHeader('Content-Type', 'application/x-www-form-urlencoded');
        request.setHeader('Authorization', authorizationHeader);

There is no hard Coded value in My code, username and password is the input parameter for this method.

request.setHeader('Authorization', authorizationHeader); --> In Apex PMD report, Secutiry issue showing in this line.

Gone through this link, still can't able to find the cause. https://pmd.github.io/latest/pmd_rules_apex_security.html#apexsuggestusingnamedcred

Answer 1

This is more of a suggestion than a hard rule. There are obviously times when you need to use direct authorization for some reason. This rule suggests that you should use Named Credentials when possible, because it is inherently more secure. If your use case warrants it, you can suppress this warning via @SuppressWarnings.

Answer 2

look out to this reference: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm

HttpRequest req = new HttpRequest();
req.setEndpoint('callout:My_Named_Credential/some_path');
req.setMethod('GET');
Http http = new Http();
HTTPResponse res = http.send(req);
System.debug(res.getBody());

I guess the pmd marks it as an error because you shouldn't set the header directly in the code, so even if there is no plain password in the string it marks this line as a warning.

as sfdcfox already mention you can ignore this warning or try to solve it with named_credentials (if it is possible)

Greets, Bernhard