Skip to content
Sarj Repo Standards
rest/security/oauth-password-grant

OAuth password flow

OAuth schemes avoid exposing resource-owner credentials to clients.

error

Examples

FlaggedFails
{
  "documents": {
    "openapi.json": {
      "components": {
        "securitySchemes": {
          "oauth": {
            "flows": {
              "password": {}
            },
            "type": "oauth2"
          }
        }
      },
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}
PassesClean
{
  "documents": {
    "openapi.json": {
      "components": {
        "securitySchemes": {
          "oauth": {
            "flows": {
              "authorizationCode": {}
            },
            "type": "oauth2"
          }
        }
      },
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}

Why it matters

The flow exposes the resource owner's credentials directly to the client.

How detection works

An OAuth 2.0 security scheme declares flows.password.

What is inspected

  • the exact components.securitySchemes.*.flows.password key

Limits

  • assessing runtime token security
  • Only exact flow keys under a security scheme whose type is oauth2 are checked.
  • Scheme names, descriptions, and non-OAuth scheme types are ignored.

How to fix it

Replace the password flow.

  1. Select a reviewed OAuth flow that does not expose user credentials to the client.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.