Project: KICS (Provisioning / Security & Compliance)
File: 3ba0cca1-b815-47bf-ac62-1e584eb64a05.md

title: Invalid OAuth2 Token URL (v3) hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3ba0cca1-b815-47bf-ac62-1e584eb64a05 Query name: Invalid OAuth2 Token URL (v3) Platform: OpenAPI Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: OAuth2 security scheme flow requires a valid URL in the tokenUrl field<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="23" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: 200 response content: application/json: components: securitySchemes: oAuth2AuthCodePos1: type: oauth2 description: For more information, see https://api.my.company.com/docs/oauth flows: authorizationCode: authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: http://example.com#@evil.com/ scopes: read:api: read your apis ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="12" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 components: securitySchemes: oAuth2AuthCodePos2: type: oauth2 description: For more information, see https://api.my.company.com/docs/oauth flows: password: tokenUrl: inval`id scopes: read:api: read your apis paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: 200 response content: application/json: ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="22" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: 200 response content: application/json: components: securitySchemes: oAuth2AuthCodePos3: type: oauth2 description: For more information, see https://api.my.company.com/docs/oauth flows: clientCredentials: tokenUrl: httxps//|api scopes: read:api: read your apis ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="31" { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": null } } } } } }, "components": { "securitySchemes": { "oAuth2AuthCodePos1": { "type": "oauth2", "description": "For more information, see https://api.my.company.com/docs/oauth", "flows": { "authorizationCode": { "authorizationUrl": "https://api.my.company.com/oauth/authorize", "tokenUrl": "http://example.com#@evil.com/", "scopes": { "read:api": "read your apis" } } } } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="14" { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version":

}, "components": { "securitySchemes": { "oAuth2AuthCodePos2": { "type": "oauth2", "description": "For more information, see https://api.my.company.com/docs/oauth", "flows": { "password": { "tokenUrl": "inval`id", "scopes": { "read:api": "read your apis" } } } } } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": null } } } } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="30" { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": null } } } } } }, "components": { "securitySchemes": { "oAuth2AuthCodePos3": { "type": "oauth2", "description": "For more information, see https://api.my.company.com/docs/oauth", "flows": { "clientCredentials": { "tokenUrl": "httxps//|api", "scopes": { "read:api": "read your apis" } } } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: 200 response content: application/json: components: securitySchemes: oAuth2AuthCodeNeg1: type: oauth2 description: For more information, see https://api.my.company.com/docs/oauth flows: authorizationCode: authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: http://localhost.com:8080 ``` ```json title="Negative test num. 2 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": null } } } } } }, "components": { "securitySchemes": { "oAuth2AuthCodeNeg2": { "type": "oauth2", "description": "For more information, see https://api.my.company.com/docs/oauth", "flows": { "authorizationCode": { "authorizationUrl": "https://api.my.company.com/oauth/authorize", "tokenUrl": "https://api.my.company.com/oauth/token" } } } } } } ``` ```yaml title="Negative test num. 3 - yaml file" openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': description: 200 response content: application/json: components: securitySchemes: oAuth2AuthCodeNeg3: type: oauth2 description: For more information, see https://api.my.company.com/docs/oauth flows: authorizationCode: authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: read:api: read your apis ```