owasp-jwt-best-practices

Security schemes that explicitly declare bearerFormat: JWT should describe their use of RFC8725, the JSON Web Token best current practices.

This is a documentation warning. The rule checks for the literal text RFC8725 in the description. It does not test token signatures, claims, algorithms, or runtime validation. OAuth alone does not imply JWTs, so an OAuth security scheme without a JWT declaration is not reported.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths: {}
components:
  securitySchemes:
    NuggetsAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Send a bearer token with each request.

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths: {}
components:
  securitySchemes:
    NuggetsAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT validation follows RFC8725, including algorithm and issuer checks.

How do I fix this violation?

Document the JWT practices your API actually implements and reference RFC8725 in the security scheme’s description. Verify those practices in runtime tests too. Adding the text alone does not make token handling secure.