owasp-rate-limit-retry-after
This rule checks the headers map on explicit 429 responses for a Retry-After declaration. Use the header spelling shown. It does not validate the header value or runtime behavior.
Current limitation: a 429 response with no headers map is skipped. Declare Retry-After even if that omission produces no finding.
Bad example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/chickenNuggets:
get:
responses:
'429':
description: Too many requests
headers:
Content-Type:
schema:
type: string
Good example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/chickenNuggets:
get:
responses:
'429':
description: Too many requests
headers:
Retry-After:
description: Seconds until the next attempt
schema:
type: integer
How do I fix this violation?
Declare Retry-After in the 429 response headers. The separate owasp-define-error-responses-429 rule requires the response and its body schema.