OpenAPI If the security scheme is not of type 'oauth2', the array value must be empty misconfigurati

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_2
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

Restrict the security section of OpenAPI documents to only include OAuth 2.0 authorization schemes defined in the security definitions section to prevent unauthorized access to the API. This is achieved by ensuring that only OAuth 2.0 schemes defined in the security section have a value.

How to Fix

To fix this issue, you need to modify the specification of your OAuth2 authentication to not use 'password' flow. This is because 'password' flow of OAuth2 authentication is less secure compared to other flows like 'authorization_code', 'implicit', etc.

The above code is secure because it uses 'implicit' and 'authorizationCode' flows of OAuth2 authentication instead of the 'password' flow. Both 'implicit' and 'authorizationCode' flows are OAuth2's response types that are more secure than the 'password' flow. 'implicit' flow is recommended for applications whose server side components are not capable of maintaining the confidentiality of the client secret while 'authorizationCode' flow is used when the client is confidential (can keep a secret) and maintains a server-side component. [source,go]

components: securitySchemes: OAuth2: type: oauth2 flows: implicit: authorizationUrl: http://api.example.com/auth scopes: read: Grants read access write: Grants write access authorizationCode: authorizationUrl: http://api.example.com/auth tokenUrl: http://api.example.com/token scopes: admin: Grants access to admin operations