200 response should be defined for OPTIONS operations

Description

OPTIONS operations in your API must have the 200 response defined.

For more details, see RFC 7231.

Example

The following is an example of how this type of risk could look in your API definition:

1options:
2  description: Returns allowed methods
3  # ...
4  responses:
5    "429":
6      description: Too many requests
7      content:
8        application/json:
9          schema:
10            $ref: "#/components/responses/429"
11

Remediation

Define 200 responses for all OPTIONS operations.

1options:
2  description: Returns allowed methods
3  # ...
4  responses:
5    "200":
6      description: OK
7      headers:
8        Allow: GET, HEAD, PUT
9    "429":
10      description: Too many requests
11      content:
12        application/json:
13          schema:
14            $ref: "#/components/responses/429"
15

Copyright 42Crunch 2021