PRC003 — Weak authentication scheme

What it catches

A defined security scheme that is:

• an API key sent in the query string (type: apiKey, in: query);
• HTTP Basic (type: http, scheme: basic).

Why it matters

API key in the query string. URLs are written everywhere: web server and proxy access logs, browser history, monitoring tools, the Referer header sent to other sites. A key in the URL ends up in all of them, and whoever reads them can reuse it.

HTTP Basic. The user's real password travels with every request. One leaked request leaks the password itself, which cannot expire on its own, cannot be limited to some operations, and is often reused on other sites.

How to fix it

• API key: send it in a header (in: header, e.g. X-API-Key).
• HTTP Basic: exchange the password once for a short-lived token (OAuth2, or type: http, scheme: bearer) and send the token.

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the security scheme, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

components:
  securitySchemes:
    basic:
      type: http
      scheme: basic
      x-procyon-ignore:
        - rule: PRC003
          reason: "Only the legacy importer uses it, behind the VPN"

Examples

Reported:

components:
  securitySchemes:
    queryKey:
      type: apiKey
      in: query
      name: api_key
    basic:
      type: http
      scheme: basic

Not reported:

components:
  securitySchemes:
    headerKey:
      type: apiKey
      in: header
      name: X-API-Key
    bearer:
      type: http
      scheme: bearer