> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-12.md).

# Security definition uses the deprecated implicit flow on OAuth2 misconfiguration detected in code

## Rule Details

|                        |                        |
| ---------------------- | ---------------------- |
| Cortex AppSec Rule ID  | APPSEC\_OPENAPI\_12    |
| Category - Subcategory | Public Exposure - APIs |
| Provider               | OTHER                  |
| Severity               | MEDIUM                 |
| Framework              | OpenAPI                |

## Impact

This rule is evaluating if a security definition is utilizing the implicit flow on OAuth2 in version 2.0 files. Implicit flow is a part of OAuth 2.0, which allows a client application to obtain an access token directly from an authorization server, without needing an authorization code first. It's primarily used for applications that run inside the browser where having a client secret is not secure.

However, the use of implicit flow in OAuth2 is considered outdated and insecure, thus it's been deprecated. It exposes a higher risk of access tokens being compromised because they can be potentially intercepted by malicious actors during transmission from the authorization server to the client.

So, use of implicit flow can lead to security breaches and unauthorized access to sensitive data or functionalities. That's why it's considered bad and a best practice to avoid its use in security definitions.

## How to Fix

Restrict the security section of OpenAPI documents to only include OAuth 2.0 authorization schemes, add the following code to your Terraform file during buildtime.

*OpenAPI*

## Ensure that your generated OpenAPI document does not include a security section for authentication types that are not OAuth 2.0. Below is an example: \[source,go]

securityDefinitions: some\_auth: type: basic

* security:
* * some\_auth:
* ```
   - write: some
  ```
* ```
   - read: some
  ```

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-12.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.