TentyAPI descriptions
An API description, usually an OpenAPI or Swagger file, lists every endpoint of your app and says which ones need a credential. The server has to enforce what the file says.
What it is
Each operation in the file can carry a security requirement, or inherit one from the top of the file. The requirement names a scheme such as bearerAuth or apiKey. The finding appears when the file asks for a credential on an operation and the server answers it without one.
Why it matters
The description is documentation, and the server is the lock. When they disagree, the people who wrote client code and reviews trust the file while the data is open to every visitor. Tenty rates the finding high because the operation returns real data to a caller who sent no credential.
How Tenty checks it
Tenty finds the description at the usual paths, such as /openapi.json, /v3/api-docs and /swagger.json, or at the path your scripts name. It picks the GET operations that need a credential according to the file, leaving out operations with path parameters, required input or a request body. It calls up to 15 of them with no credential. This runs for verified owners only. The finding gives the route and the scheme names. The data in the answer stays out of the report.
How to fix it
Check the credential on the server for every operation that the file marks as protected.
- Express and similar: put the authentication middleware on the router before the routes.
- FastAPI: add the security dependency to the route or to the router.
- Spring: set the matcher in the security configuration to
authenticated()for the path. - Public by choice: when the operation is meant to be public, mark it as such in the file with
security: []so the file and the server agree.
Run the reproduce command again after the change and expect a 401 or 403 answer.
How to reproduce
curl -sS -i 'https://YOUR-APP/ROUTE'Use the route from the finding. A 200 answer with data means the server accepts a caller with no credential.