Skip to content
Sarj Repo Standards
rest/security/insecure-server

Literal HTTP server URL

Literal OpenAPI server URLs use transport security.

warning beta

Examples

FlaggedFails
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      },
      "servers": [
        {
          "url": "http://api.example.test"
        }
      ]
    }
  },
  "entrypoint": "openapi.json"
}
PassesClean
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      },
      "servers": [
        {
          "url": "https://api.example.test"
        }
      ]
    }
  },
  "entrypoint": "openapi.json"
}

Why it matters

Credentials and API data can be observed or modified in transit.

How detection works

An OpenAPI Server Object contains a literal URL whose scheme is http.

What is inspected

  • parsed literal Server Object URLs at root, path, and operation scope

Limits

  • inferring deployment TLS behind a proxy
  • evaluating templated or relative URLs
  • Relative and templated URLs are ignored rather than guessed.
  • Malformed server URLs make analysis inconclusive instead of producing a finding.
  • This advisory rule does not claim to observe runtime transport configuration.

How to fix it

Use transport security for the declared server.

  1. Change the literal URL to HTTPS, or use an accurate relative or templated URL.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.