Cleartext credentials over unencrypted channel should not be accepted for the operation misconfigura

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_3
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

Sending credentials over HTTP in cleartext exposes API calls to attacks including man-in-the-middle attacks. Ensure that you are using an encrypted channel for sending credentials.

How to Fix

OpenAPI

Ensure that you aren’t using the unencryptedScheme. For example:

components:
securitySchemes:
-    unencryptedScheme:
-      type: http
-      scheme: basic
paths:
"/":
get:
security:
-        - unencryptedScheme: []