Description
Defining Basic authentication in OpenAPI 3.0 components.securitySchemes does not automatically apply it to every operation. Referencing security settings determine where it is used. type: http identifies the HTTP authentication category; server addresses and actual connection settings determine HTTPS use.
Potential impact
Sending Basic credentials over an unencrypted connection can expose usernames and passwords. Stolen passwords may also be reused.
Remediation
Use HTTPS and certificate validation wherever Basic authentication is used. If delegated user authorization is needed, consider the OAuth2 authorization code flow with PKCE and configure the actual authorization server, clients, and global or operation-level security together.
Examples
The before excerpt defines an HTTP server and Basic authentication but has no security requirement applying it. The after excerpt specifies HTTPS and OAuth2 and also adds a global authentication requirement.
Before
{
"openapi": "3.0.0",
"servers": [
{
"url": "http://kicsapi.server.com/"
}
],
"components": {
"securitySchemes": {
"regularSecurity": {
"type": "http",
"scheme": "basic"
}
}
}
}
After
{
"openapi": "3.0.0",
"servers": [
{
"url": "https://kicsapi.server.com/"
}
],
"components": {
"securitySchemes": {
"OAuth2": {
"type": "oauth2",
"flows": {
"authorizationCode": {
"authorizationUrl": "https://kicsapi.com/oauth/authorize",
"tokenUrl": "https://kicsapi.com/oauth/token",
"scopes": {
"write": "modify objects",
"read": "read objects"
}
}
}
}
}
},
"security": [
{
"OAuth2": [
"write",
"read"
]
}
]
}