Global schemes use 'httpa' protocol instead of 'https' misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_18
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

This rule is checking to ensure that global schemes in the API are using 'https' protocol instead of 'http'. 'Http' protocol is insecure as it does not encrypt the data being transferred, making it susceptible to interception by malicious third parties. On the other hand, 'https' ensures that the communication between the client and the server is encrypted, hence providing a secure connection. If an API is using 'http', it poses a security threat as confidential data transferred can be easily intercepted and misused. Ensuring that global schemes use 'https' protocol hence provides an important safeguard for sensitive data.

How to Fix

Example: [source,go]

... security:

• petstore_auth:
• write:pets
• read:pets

...