owasp-jwt-best-practices
Security schemes using JWTs must explicitly declare support for RFC8725 in the description.
Good Example
openapi: "3.1.0"
info:
version: "1.0"
components:
securitySchemes:
"goodOAuth2":
type: oauth2
description: RFC8725 Compliant JWT
"goodBearerJWT":
type: http
bearerFormat: jwt
description: "This is also a RFC8725 compliant JWT
Bad Example
openapi: 3.1.0
info:
version: 1.0
components:
securitySchemes:
"badOAuth2":
type: oauth2
description: No way of knowing if these JWTs are following best practices.
"badBearerJWT":
type: http
bearerFormat: jwt
description: No way of knowing if these JWTs are following best practices.
How do I fix this violation?
Explicitly state, in the description of the security schemes, that it allows for support of the RFC8725:
https://datatracker.ietf.org/doc/html/rfc8725.