Project: KICS (Provisioning / Security & Compliance)
File: 33d96c65-977d-4c33-943f-440baca49185.md

title: Invalid OAuth2 Authorization URL (v2) hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 33d96c65-977d-4c33-943f-440baca49185 Query name: Invalid OAuth2 Authorization URL (v2) Platform: OpenAPI Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: The field authorizationUrl on implicit or authorizationCode fields from OAuth must be a valid URL<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="19 23" swagger: "2.0" info: title: Simple API Overview version: 1.0.0 license: name: "Apache 2.0" url: "https://www.apache.org/licenses/LICENSE-2.0.html" paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response securityDefinitions: api_key: type: oauth2 authorizationUrl: https://api.invalid.comp@#any.com/oauth/authorize flow: accessCode petstore_auth: type: oauth2 authorizationUrl: https://api.invalid.comp@#any.com/oauth/authorize flow: implicit scopes: write:pets: modify pets in your account read:pets: read your pets ``` ```json title="Positive test num. 2 - json file" hl_lines="32 27" { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": { "api_key": { "type": "oauth2", "authorizationUrl": "https://api.invalid.comp@#any.com/oauth/authorize", "flow": "accessCode" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "https://api.invalid.comp@#any.com/oauth/authorize", "flow": "implicit", "scopes": { "write:pets": "modify pets in your account", "read:pets": "read your pets" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" swagger: "2.0" info: title: Simple API Overview version: 1.0.0 license: name: "Apache 2.0" url: "https://www.apache.org/licenses/LICENSE-2.0.html" paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response securityDefinitions: api_key: type: oauth2 authorizationUrl: http://swagger.io/api/oauth/apikey flow: accessCode petstore_auth: type: oauth2 authorizationUrl: http://swagger.io/api/oauth/dialog flow: implicit scopes: write:pets: modify pets in your account read:pets: read your pets ``` ```json title="Negative test num. 2 - json file" { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": { "api_key": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/apikey", "flow": "accessCode" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "modify pets in your account", "read:pets": "read your pets" } } } } ```