OpenAPI Security object for operations, if defined, must define a security scheme, otherwise it shou

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_5
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

If security schemes are not defined in OpenAPI Security Objects for Operations, the API may be exposed without proper authentication, which could lead to unauthorized access. This could result in security vulnerabilities that can be exploited by attackers to gain access to sensitive data or perform unauthorized actions.

How to Fix

OpenAPI

Ensure that you have an authentication type in the security section of your path. For example:

paths:
  "/":
    get:
      operationId: id
      summary: example
-     security: []
+     security:
+       - OAuth2:
+           - write