OpenAPITools / OpenAPITools/openapi-generator

[BUG] [SPRING-CLOUD] Security config is not wrong for feign client

Open
#16,049 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

If there are multiple security schemes, the Feign client will simply use all of them instead of the assigned one.

Example

  /foo:
    get:
    ...
      security:
        - foo: [ ]
  /bar:
    get:
    ...
      security:
        - bar: [ ]

  securitySchemes:
    foo:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: 'foo/auth'
          tokenUrl: 'foo/token'
          scopes: { }
        clientCredentials:
          tokenUrl: '/foo/token'
          scopes: { }
    bar:
      type: http
      scheme: basic

However, the Feign client always uses ALL secruity methods instead of a special one.
I know how to fix the ClientConfiguration.

However, I have problems at this point.
How do I find out which secruity (bar or foo) was assigned to the resource?

Code:

@FeignClient(name="${{openbrace}}{{classVarName}}.name:{{classVarName}}{{closebrace}}", {{#useFeignClientUrl}}url="${{openbrace}}{{classVarName}}.url:{{basePath}}{{closebrace}}", {{/useFeignClientUrl}}configuration = ClientConfiguration.class)
public interface {{classname}}Client extends {{classname}} {
}

Here in the last line I need a if or the information which security method is assignedconfiguration = ClientConfiguration.class

Is there a possibilty to get this information?
@wing328 @welshm @borsch any ideas?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the generated Feign client template shown in the issue and trace how ClientConfiguration is applied. Determine how the OpenAPI operation's assigned security scheme can reach that configuration; done means separate resources use their assigned security method instead of all available methods.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi, spring
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.