owasp-no-http-basic

Security scheme uses HTTP Basic. Use a more secure authentication method, like OAuth 2.0

Basic authentication encodes credentials but does not encrypt them. TLS protects the transport. This rule checks the declared authentication scheme; it does not inspect network traffic.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  securitySchemes:
    "please-hack-me":
      type: "http"
      scheme: basic
paths: {}

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  securitySchemes:
    "someSecurityScheme":
      type: "http"
      scheme: "bearer"
paths: {}

How do I fix this violation?

This rule reports HTTP schemes basic and negotiate.

Do not use basic authentication, use a more secure authentication method (e.g., bearer).