When scanning APIs that require authentication, you may need to manually edit your downloaded OpenAPI JSON file to include securitySchemes and apply them to specific paths. This ensures VulnAPI can test protected endpoints.
To add Bearer authentication, include a bearerAuth definition in the components.securitySchemes section and reference it in the security array of the relevant operations.
Example OpenAPI Configuration Snippet:
{
"openapi": "3.0.1",
"info": {
"title": "VAmPI",
"version": "0.1"
},
"servers": [
{
"url": "http://localhost:5000"
}
],
"paths": {
"/users/v1/{username}/email": {
"put": {
"operationId": "api_views.users.update_email",
"security": [
{
"bearerAuth": []
}
]
}
}
},
"components": {
"securitySchemes": {
"bearerAuth": {
"type": "http",
"scheme": "bearer",
"bearerFormat": "JWT"
}
}
}
}
{
"components": {
"securitySchemes": {
"bearerAuth": {
"bearerFormat": "JWT",
"scheme": "bearer",
"type": "http"
}
}
},
"info": {
"description": "OpenAPI v3 specs for VAmPI",
"title": "VAmPI",
"version": "0.1"
},
"openapi": "3.0.1",
"paths": {
"/users/v1/{username}/email": {
"put": {
"description": "Update a single users email",
"operationId": "api_views.users.update_email",
"security": [
{
"bearerAuth": []
}
]
}
}
},
"servers": [
{
"url": "http://localhost:5000"
}
]
}
