owasp-security-hosts-https-oas3

All server interactions should use HTTPS. A secure root server does not help if an operation overrides it with an insecure URL.

This rule checks servers at the root, path, and operation levels, including webhook and callback paths. It also checks server-variable defaults and declared enum values.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
servers:
  - url: https://api.quobix.com
paths:
  /chickenNuggets:
    get:
      servers:
        - url: http://api.quobix.com
      responses:
        '200':
          description: Chicken nuggets

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
servers:
  - url: https://api.quobix.com
paths:
  /chickenNuggets:
    get:
      servers:
        - url: https://api.quobix.com
      responses:
        '200':
          description: Chicken nuggets

Server variables

A secure default does not make an insecure enum value safe. This declaration also fails:

servers:
  - url: '{scheme}://api.quobix.com'
    variables:
      scheme:
        default: https
        enum: [https, http]

How do I fix this violation?

Use https:// for explicit server URLs, and remove insecure values from server variables. The check compares the URL scheme, so a prefix such as https-insecure:// does not pass.

Relative URLs, such as /v1 or //api.quobix.com/v1, are accepted because they inherit transport from their deployment location. Serve that location over HTTPS. This rule does not test the deployed server or resolve callback destinations.