Authentication Security Best Practices

general > oauth2-redirections-non-encrypted

Guidance / Message

Oauth2 redirection flows use non encrypted transport

Examples

valid

openapi: 3.0.0
info:
  title: My API
  description: This is a sample API
  version: 1.0.0
servers:
  - url: https://api.example.com/v1

invalid

openapi: 3.0.0
info:
  title: My API
  description: This is a sample API
  version: 1.0.0
servers:
  - url: http://api.example.com/v1

Applies to OAuth2Flow

Constraint

Type: Declarative Validation