OWASP Functions
Open Worldwide Application Security Project (OWASP) Functions for OWASP Rules.
These functions power a portion of the OWASP Rules.
owaspAuthURLsHTTPS
Checks transport declarations for OAuth and OpenID Connect endpoints.owaspOAuthFlow
Checks for an insecure OAuth flow.owaspExternalExample
Checks that an external example and an example are not used together.owaspArrayLimit
Checksarray schema types also define maxItems
owaspAuthInsecureSchemes
Checks for insecure HTTP authentication schemes.owaspBasicAuth
Checks no Basic auth is used in the API.owaspCheckErrorResponse
Checks if an error response has been defined for a given status code.owaspHostsHttps
Checks server URLs and variable values for insecure transport.owaspIntegerFormat
Checks integers specify format (int32 or int64)owaspIntegerLimit
Checks integers specifyminimum and maximum or exclusiveMinimum and exclusiveMaximum
owaspJWTBestPractice
Checks whether declared JWTs document RFC8725.owaspNoAdditionalProperties
Checks request objects for unrestricted additional properties.owaspNoAdditionalPropertiesConstrained
Checks request maps for a property-count limit.owaspNoApiKeyInUrl
Checks no parameters are used in the URL to pass API keys.owaspNoCredentialsInUrl
Checks no credentials are used in the URL.owaspNoNumericIds
Checks that no numeric IDs are used in the API.owaspRatelimitRetryAfter
Checks that any429 response, contains a Retry-After header.
owaspStringLimit
Checks strings specify maxLength, enum, or constowaspStringRestricted
Checks strings must specify aformat, pattern, enum, or const