owaspAuthURLsHTTPS

owaspAuthURLsHTTPS checks OAuth authorizationUrl, tokenUrl, and refreshUrl, plus OpenID Connect openIdConnectUrl. Explicit URL schemes must be https. Relative URLs are accepted. The function does not contact the endpoints.

Example ruleset configuration

my-security-rule:
  description: Checks transport declarations for OAuth and OpenID Connect endpoints.
  type: validation
  given: $
  then:
    function: owaspAuthURLsHTTPS

Used by the following rules:

• owasp-auth-urls-https