owasp-define-error-validation
Check that an error response of either 400, 422 or 4XX has been defined. This rule checks the response code declaration; it does not require a body schema.
Carefully define schemas for all the API responses, including either 400, 422 or 4XX
responses which describe errors caused by invalid request
Bad example
openapi: 3.1.0
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
Good Example
openapi: 3.1.0
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/no-error-response:
get:
responses:
200:
description: OK
content:
"application/problem+json": {}
422:
description: Unprocessable Entity
content:
"application/problem+json": {}
How do I fix this violation?
Extend the responses of all endpoints to support either 400, 422, or 4XX error codes.
Don’t let the consumer guess what errors might be and how gamble with how to deal with those errors.