Path Server Object Uses HTTP (v3)

• Query id: 9670f240-7b4d-4955-bd93-edaa9fa38b58
• Query name: Path Server Object Uses HTTP (v3)
• Platform: OpenAPI
• Severity: Medium
• Category: Encryption
• CWE: 319
• URL: Github

Description

The property 'url' in the Path Server Object should only allow 'HTTPS' protocols to ensure an encrypted connection
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API overview",
    "version": "1.0.0"
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "servers": [
          {
            "url": "https://development.gigantic-server.com/v1",
            "description": "Development server"
          },
          {
            "url": "http://staging.gigantic-server.com/v1",
            "description": "Staging server"
          },
          {
            "url": "https://api.gigantic-server.com/v1",
            "description": "Production server"
          }
        ],
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "examples": {
                  "foo": {
                    "value": {
                      "versions": [
                        {
                          "status": "CURRENT",
                          "updated": "2011-01-21T11:33:21Z",
                          "id": "v2.0",
                          "links": [
                            {
                              "href": "http://127.0.0.1:8774/v2/",
                              "rel": "self"
                            }
                          ]
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Positive test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API overview
  version: 1.0.0
paths:
  "/":
    get:
      operationId: listVersionsv2
      summary: List API versions
      servers:
        - url: https://development.gigantic-server.com/v1
          description: Development server
        - url: https://staging.gigantic-server.com/v1
          description: Staging server
        - url: http://api.gigantic-server.com/v1
          description: Production server
      responses:
        "200":
          description: 200 response
          content:
            application/json:
              examples:
                foo:
                  value:
                    versions:
                      - status: CURRENT
                        updated: "2011-01-21T11:33:21Z"
                        id: v2.0
                        links:
                          - href: http://127.0.0.1:8774/v2/
                            rel: self

Code samples without security vulnerabilities

Negative test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API overview",
    "version": "1.0.0"
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "servers": [
          {
            "url": "https://development.gigantic-server.com/v1",
            "description": "Development server"
          },
          {
            "url": "https://staging.gigantic-server.com/v1",
            "description": "Staging server"
          },
          {
            "url": "https://api.gigantic-server.com/v1",
            "description": "Production server"
          }
        ],
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "examples": {
                  "foo": {
                    "value": {
                      "versions": [
                        {
                          "status": "CURRENT",
                          "updated": "2011-01-21T11:33:21Z",
                          "id": "v2.0",
                          "links": [
                            {
                              "href": "http://127.0.0.1:8774/v2/",
                              "rel": "self"
                            }
                          ]
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Negative test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API overview
  version: 1.0.0
paths:
  "/":
    get:
      operationId: listVersionsv2
      summary: List API versions
      servers:
        - url: https://development.gigantic-server.com/v1
          description: Development server
        - url: https://staging.gigantic-server.com/v1
          description: Staging server
        - url: https://api.gigantic-server.com/v1
          description: Production server
      responses:
        "200":
          description: 200 response
          content:
            application/json:
              examples:
                foo:
                  value:
                    versions:
                      - status: CURRENT
                        updated: "2011-01-21T11:33:21Z"
                        id: v2.0
                        links:
                          - href: http://127.0.0.1:8774/v2/
                            rel: self