owaspOAuthFlow
owaspOAuthFlow checks OAuth security schemes for the configured flow. Set flow to password or implicit. Missing, empty, or unsupported values are reported as invalid options.
How do I use this function?
| NAME | TYPE | REQUIRED? | DESCRIPTION |
|---|---|---|---|
| flow | string |
yes | OAuth flow to report: password or implicit. |
Example ruleset configuration
my-oauth-rule:
description: Do not use the OAuth password flow.
type: validation
given: $
then:
function: owaspOAuthFlow
functionOptions:
flow: password
Use flow: implicit to check implicit flows. For HTTP authentication schemes, use owaspAuthInsecureSchemes.
Used by the following rules: