owasp-define-error-validation
Check that an error response of either 400, 422 or 4XX has been defined.
Carefully define schemas for all the API responses, including either 400, 422 or 4XX
responses which describe errors caused by invalid request
Bad example
openapi: 3.1.0
info:
version: 1.0
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
Good Example
openapi: 3.1.0
info:
version: 1.0
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
422:
description: Unprocessable Entity
content:
"application/problem+json": {}
How do I fix this violation?
Extend the responses of all endpoints to support either 400, 422, or 4XX error codes.
Don’t let the consumer guess what errors might be and how gamble with how to deal with those errors.