Skip to main content

no-http-basic

Flags OpenAPI security schemes with type: http and scheme: basic.

AttributeValue
CategorySecurity
MaturityPlatinum
LenientWarning
Recommended–CompleteError

See it fail​

basicAuth:
  type: http
  scheme: basic

Fix it​

Use a stronger supported scheme, such as OAuth2 or bearer tokens, according to the API threat model.

Nearby: no-insecure-http-auth-schemes, security-scheme-oauth2.