owasp-no-credentials-in-url
Keep security credentials out of paths and query parameters!
URL parameters must not contain credentials such as API key, password, or secret.
The check matches credential-like parameter names in path and query parameters, without regard to case. It does not inspect the values sent to the running API.
Bad example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/chickenNuggets:
get:
parameters:
- name: client_secret
in: query
schema:
type: string
responses:
'200':
description: OK
Good example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
security:
- NuggetsAuth: []
paths:
/chickenNuggets:
get:
responses:
'200':
description: OK
components:
securitySchemes:
NuggetsAuth:
type: http
scheme: bearer
How do I fix this violation?
Remove credentials from URL parameters. Use an appropriate authentication scheme and send credentials in HTTP headers.