Description
In OpenAPI 3.0, type: http with scheme: oauth describes legacy OAuth authentication. Review authorization-server and client support when adding integrations or planning a migration. This declaration alone neither establishes an authentication vulnerability nor completes a move to OAuth2.
Potential impact
- An unsupported authentication method can complicate new client or gateway integrations and maintenance.
- A mismatch between the documented and implemented flow can cause clients to transmit credentials incorrectly or fail to authenticate.
Remediation
Choose a supported OAuth2 flow and migrate the authorization server, clients and API together. Apply current protections such as PKCE for authorization-code flows, and check HTTPS, redirect URIs and required scopes. Verify the behavior before updating the OpenAPI security scheme and security requirements.
Examples
These excerpts define security schemes. Replace endpoints and scopes with actual service values, and specify the security requirements for the operations separately.
Before
{
"openapi": "3.0.0",
"components": {
"securitySchemes": {
"petstore_auth": {
"type": "http",
"scheme": "oauth"
}
}
}
}
After
{
"openapi": "3.0.0",
"components": {
"securitySchemes": {
"petstore_auth": {
"type": "oauth2",
"flows": {
"authorizationCode": {
"authorizationUrl": "https://example.com/api/oauth/dialog",
"tokenUrl": "https://example.com/api/oauth/token",
"scopes": {
"read:pets": "read your pets"
}
}
}
}
}
}
}
The revised example documents an OAuth2 authorization-code flow. This definition alone does not configure PKCE or server-side token validation.