OAuth2 security definitions includes password flow in OpenAPI 2.0 file misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_10
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

This rule is looking for instances in API definitions where the 'password' flow is being used in OAuth2 authentication, specifically within version 2.0 files. The 'password' flow, also known as the resource owner password credentials grant, could potentially place the application at a higher risk as it involves sharing the user's password with the client application. If not managed securely, it could lead to unauthorized access or data breaches. Therefore, it's recommended to use more secure methods of authentication to protect sensitive information.

How to Fix

To fix the issue, you need to change the schemes from 'http' to 'https'. You should update the schemes field in the OpenAPI document to only include 'https' and remove 'http'.

The above code is secure because it ensures that all data transmitted between the client and server is encrypted, preventing man-in-the-middle attacks, eavesdropping, and data tampering. This is essential for protecting sensitive information such as usernames, passwords, and API keys. [source,go]

swagger: '2.0' info: version: 1.0.0 title: Simple API schemes:

• https

---