OWASP API2 2023 No HTTP Basic (Edit)

Basic authentication credentials transported over network are more susceptible to interception than other forms of authentication, and as they are not encrypted it means passwords and tokens are more easily leaked.

OWASPSecurityAuthenticationOpenAPI

Rule Definition

owasp-api2-2023-no-http-basic-error.yaml 
{"owasp-api2-2023-no-http-basic-error":{"description":"Basic authentication credentials transported over network are more susceptible to interception than other forms of authentication, and as they are not encrypted it means passwords and tokens are more easily leaked.","message":"Security scheme uses HTTP Basic. Use a more secure authentication method, like OAuth 2 or OpenID.","given":"$.components.securitySchemes[*]","severity":"error","then":{"field":"scheme","function":"pattern","functionOptions":{"notMatch":"basic"}}}}

Back to All of the Rules