owaspJWTBestPractice

owaspJWTBestPractice checks security schemes with bearerFormat: JWT for the literal text RFC8725 in their description. The format check is case-insensitive. OAuth alone does not imply JWTs.

This is a documentation check, not runtime token validation. The built-in rule reports a warning.

Example ruleset configuration

my-security-rule:
  description: Checks whether declared JWTs document RFC8725.
  type: validation
  given: $
  then:
    function: owaspJWTBestPractice

Used by the following rules:

• owasp-jwt-best-practices