owaspHostsHttps

owaspHostsHttps checks root, path, operation, webhook, and callback server URLs. It expands server-variable defaults and checks declared enum values. Explicit schemes must be https; relative URLs are accepted.

Example ruleset configuration

my-security-rule:
  description: Checks server URLs and variable values for insecure transport.
  type: validation
  given: $
  then:
    function: owaspHostsHttps

Used by the following rules:

• owasp-security-hosts-https-oas3