Security definition uses the deprecated implicit flow on OAuth2 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_12
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	MEDIUM
Framework	OpenAPI

Impact

This rule is evaluating if a security definition is utilizing the implicit flow on OAuth2 in version 2.0 files. Implicit flow is a part of OAuth 2.0, which allows a client application to obtain an access token directly from an authorization server, without needing an authorization code first. It's primarily used for applications that run inside the browser where having a client secret is not secure.

However, the use of implicit flow in OAuth2 is considered outdated and insecure, thus it's been deprecated. It exposes a higher risk of access tokens being compromised because they can be potentially intercepted by malicious actors during transmission from the authorization server to the client.

So, use of implicit flow can lead to security breaches and unauthorized access to sensitive data or functionalities. That's why it's considered bad and a best practice to avoid its use in security definitions.

How to Fix

Restrict the security section of OpenAPI documents to only include OAuth 2.0 authorization schemes, add the following code to your Terraform file during buildtime.

OpenAPI

Ensure that your generated OpenAPI document does not include a security section for authentication types that are not OAuth 2.0. Below is an example: [source,go]

securityDefinitions: some_auth: type: basic

• security:
• • some_auth:
•  - write: some

•  - read: some

---