owasp-define-error-responses-401
OWASP API Security recommends defining schemas for all responses. This includes the 401 response error code.
Bad example
openapi: 3.1.0
info:
version: 1.0
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
Good Example
openapi: 3.1.0
info:
version: 1.0
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
401:
description: Access Denied!
content:
"application/problem+json": {}
How do I fix this violation?
Extend the responses of all endpoints to include 401 response error codes.