Description
When global security requires API key authentication, requests using that authentication must send the key over HTTPS. Sending it over unencrypted HTTP can expose the key in transit.
Potential impact
Someone observing the traffic may obtain the key and call the API with its granted permissions.
Remediation
Configure the API server and clients to use HTTPS only, and reflect this in the documentation. Check the URLs in servers for OpenAPI 3.0 or schemes for 2.0. Send keys in headers instead of URLs and keep them out of logs.
Examples
These OpenAPI 3.0 excerpts change the API server URL from HTTP to HTTPS and show OAuth2 as an option. API traffic still needs HTTPS when using OAuth2; retaining API keys with HTTPS and headers is also valid. Keep the document and actual server and client settings aligned.
Before
{
"openapi": "3.0.0",
"servers": [{"url": "http://api.example.com"}],
"security": [
{
"apiKeyAuth": []
}
],
"components": {
"securitySchemes": {
"apiKeyAuth": {
"type": "apiKey",
"name": "X-API-Key",
"in": "query"
}
}
}
}
After
{
"openapi": "3.0.0",
"servers": [{"url": "https://api.example.com"}],
"security": [
{
"OAuth2": [
"read"
]
}
],
"components": {
"securitySchemes": {
"OAuth2": {
"type": "oauth2",
"flows": {
"authorizationCode": {
"authorizationUrl": "https://example.com/oauth/authorize",
"tokenUrl": "https://example.com/oauth/token",
"scopes": {
"read": "read objects in your account"
}
}
}
}
}
}
}