OpenAPITools / OpenAPITools/openapi-generator

[BUG][C++][cpp-pistache-server] HTTP authentication (basic/bearer) missing from generated code

Open
#1,873 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug Server: C++
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Description

When I add an HTTP authentication scheme like ,e.g., Basic or Bearer to my specification, the genereated C++ Pistache code does neither provide username/password nor the bearer token to the called template method. In fact, nowhere in the generated code does any authentication/authorization logic appear.

openapi-generator version

Release 3.3.4

OpenAPI declaration file content or url
    openapi: 3.0.0

    info:
      title: Simple Example API
      description: Show case for missing authorization in codegen
      version: 1.0.0

    components:
      securitySchemes:
        basicAuth:
          type: http
          scheme: basic
        bearerAuth:
          type: http
          scheme: bearer
          bearerFormat: JWT

    security:
      - basicAuth: []
      - bearerAuth: []

    paths:
      /foo:
        get:
          responses:
            '200':
              description: Some foo
              content:
                application/json:
                  schema: 
                    type: string
Command line used for generation

java -jar openapi-generator-cli.jar generate -i my_showcase.yaml -g cpp-pistache-server -o MyPistacheShowCase

Steps to reproduce

Copy above YAML code in a file named "my_showcase.yaml" and execute above command line. Check C++ Pistache code.

Expected behaviour

In generated method DefaultApi::foo_get_handler username/password and bearer token are extracted from the header and passed on to the virtual template method DefaultApi::foo_get.

Even better, another central, virtual template method DefaultApi::checkAuth could be added by the generator and could be called before DefaultApi::foo_get. The user could then implement DefaultApi::checkAuth with some logic for checking the credentials or bearer token without having the burden to manually repeat that in every single ressource-method.

Actual behaviour

There is no security logic added to the generate code whatsoever. Thus, the generated server stub is useless, because the user cannot even access the authorization header in DefaultApi::foo_get anymore.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by generating the cpp-pistache-server output from the supplied my_showcase.yaml command and inspect DefaultApi::foo_get_handler and DefaultApi::foo_get. Confirm that the generated server exposes the Basic credentials or Bearer token and applies the declared security requirements before invoking the template method; the issue also suggests evaluating a central DefaultApi::checkAuth hook.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
api, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.