OpenAPITools / OpenAPITools/openapi-generator

[BUG] Generated server does not use security in API handler

Open
#20,784 0 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Sponsorship to speed up the bug fix or feature request (example)

When creating a server python-fastapi with this spec

openapi: 3.0.3
info:
  title: Sample API
  description: Sample
  version: 0.0.1
  contact:
    name: Tomas

servers:
  - url: "http://localhost:8001"

tags:
  - name: home
paths:
  /home:
    get:
      tags:
        - home
      description: Get home page
      operationId: GetHome
      responses:
        "200":
          description: Successfull response
security:
  - Token: []
components:
  securitySchemes:
    Token:
      type: http
      scheme: bearer
      bearerFormat: JWT


The validation returning None does not raise any validation error, and the token decoded token is not passed as a value into the api handler, so security does not prevent anything

@router.get(
    "/home",
    responses={
        200: {"description": "Successfull response"},
    },
    tags=["home"],
    response_model_by_alias=True,
)
async def get_home(
    token_Token: TokenModel = Security(get_token_Token),
) -> None:
    """Get home page"""
    if not BaseHomeApi.subclasses:
        raise HTTPException(status_code=500, detail="Not implemented")
    return await BaseHomeApi.subclasses[0]().get_home()


Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the python-fastapi server generator and reproduce the issue using the minimal OpenAPI specification in the report. Trace how the generated security dependency validates the bearer token and how the generated API handler receives it. Done means missing or invalid security is rejected and the decoded token is available to the handler.

Written by the indexing model from the issue text.

Assessment

Tech stack
fastapi, python
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.