oauth-token-url-https-only

Flags an OAuth2 flow tokenUrl that is not an absolute HTTPS URL.

Attribute	Value
Category	Security
Maturity	Platinum
Lenient	Warning
Recommended–Complete	Error

See it fail

flows:
  clientCredentials:
    tokenUrl: http://auth.example.org/token

Fix it

Use https://auth.example.org/token.

Nearby: oauth-authorization-url-https-only, hosts-https-only.