PRC011 — OAuth2 flow is deprecated

What it catches

An OAuth2 security scheme offering the implicit or the password flow. Both are removed by the OAuth 2.0 Security Best Current Practice (RFC 9700). Each flow is reported where it is declared.

Why it matters

Implicit. The access token comes back in the browser's URL, where browser history, logs and any script on the page can read it, and nothing proves the token went to the client that asked for it.

Password (resource owner password credentials). The client collects the user's real password. Every client becomes a place passwords can leak from, and the flow cannot support multi-factor login.

How to fix it

• For users, in browsers or mobile apps: the authorizationCode flow with PKCE.
• For machine-to-machine access: the clientCredentials flow.

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the OAuth2 flow, or its security scheme, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

flows:
  password:
    tokenUrl: /oauth/token
    x-procyon-ignore:
      - rule: PRC011
        reason: "Only our first-party CLI uses it; removal tracked in #123"

Examples

Reported:

flows:
  implicit:
    authorizationUrl: https://auth.example.com/authorize
    scopes: {}

Not reported:

flows:
  authorizationCode:
    authorizationUrl: https://auth.example.com/authorize
    tokenUrl: https://auth.example.com/token
    scopes: {}