OpenAPITools / OpenAPITools/openapi-generator

[BUG][csharp] Bearer prefix added to apiKey security scheme

Open
#22,186 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
Description

When generating a C# client using apiKey as the security scheme the generated ApiKeyToken class provides a constructor parameter called prefix which is set to "Bearer " by default:

https://github.com/OpenAPITools/openapi-generator/blob/57752d190c15e52128403a74df326fae9d98afab/modules/openapi-generator/src/main/resources/csharp/libraries/generichost/ApiKeyToken.mustache#L30-L34

In my opinion this is incorrect, since I explicitly asked for a security scheme of apiKey type and not bearer. The docs also show an example that does not contain "Bearer" in the GET request (see link).
You have to explicitly set this to an empty string to get the expected behavior of an API Key.

openapi-generator version

7.16.0

OpenAPI declaration file content or url
type: apiKey
name: MyApiKey
in: header
Generation Details

I didn't provide any details on how to generate / reproduce the issue since the issue is in plain sight when looking at the aforementioned ApiKeyToken.mustache template file. It is mainly a matter of discussing what the correct method signature should be and whether or not to change this behavior.

Suggest a fix

Set the prefix parameter to an empty string by default.
Will however cause a breaking change in authentication when blindly re-generating the code using a newer generator.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with modules/openapi-generator/src/main/resources/csharp/libraries/generichost/ApiKeyToken.mustache at the referenced constructor lines, then compare the generated C# client behavior with the supplied apiKey OpenAPI declaration and the linked API-key documentation. Done means deciding and verifying whether apiKey generation should default to an empty prefix rather than "Bearer ", while accounting for the noted authentication breaking change.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, authentication, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.