Operation objects for PUT, POST, and PATCH operations do not have a 'consumes' field defined misconf

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_17
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	MEDIUM
Framework	OpenAPI

Impact

This rule checks if operation objects in the API version 2.0 files have the 'consumes' field defined for PUT, POST and PATCH operations. The 'consumes' field is important because it specifies the MIME types that the operation or endpoint can handle. If this field is not defined, the API may process requests with unspecified or incorrect content types, leading to errors or security vulnerabilities. It may also invite compatibility issues, as some clients may send requests in a format that the API does not support. Therefore, it's crucial to define the 'consumes' field for ensuring the correct operation of the API and safeguarding it from potential threats.

How to Fix

Ensure that you have an authentication type in the security section of your path. For example: [source,go]

paths: "/": get: operationId: id summary: example

• security: []

• security:

•   - OAuth2:

•       - write

---