Authentication Security Best Practices
unknown-security-scheme
general > unknown-security-scheme
Guidance
One or more global security schemes in your API allows setting HTTP authentication methods that are not included
in IANA Authentication Scheme Registry.
This is a potential risk, because the definition is in security schemes. However, it easily turns into an actual
risk when the unsafe method is used in a security requirement.
Message
One or more global security schemes in your API are not allowed by IANA Authentication Scheme Registry.
Examples
valid
components:
securitySchemes:
UnknownAuth:
type: http
scheme: basic
invalid
components:
securitySchemes:
UnknownAuth:
type: http
scheme: unknown
Applies to SecurityScheme