OWASP API2 2023 Auth Insecure Schemes (Edit)

There are many HTTP authorization schemes but some of them are now considered insecure, such as negotiating authentication using specifications like NTLM or OAuth v1.

OWASPSecurityAuthenticationOpenAPI

Rule Definition

owasp-api2-2023-auth-insecure-schemes-error.yaml
{"owasp-api2-2023-auth-insecure-schemes-error":{"description":"There are many HTTP authorization schemes but some of them are now considered insecure, such as negotiating authentication using specifications like NTLM or OAuth v1.","message":"Authentication scheme is considered outdated or insecure.","given":"$.components.securitySchemes[?(@.type==\"http\")].scheme","severity":"error","then":{"function":"pattern","functionOptions":{"notMatch":"^(negotiate|oauth)$"}}}}

Back to All of the Rules