Applications Using ROPC Authentication Flow
This rule detects the use of the Resource Owner Password Credentials (ROPC) authentication flow. ROPC is generally discouraged because it requires applications to directly handle user credentials, increasing the risk of credential compromise. While it can be used for automated testing or legacy applications, its presence in other contexts may indicate a security weakness or an attempt to bypass more secure authentication mechanisms.
Sigma
