OpenAPITools / OpenAPITools/openapi-generator

[BUG] PHPSlim4 - Want only 1 authentication method out of multiple

Open
#4,513 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Feature: Authentication Issue: Bug Server: PHP
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • What's the version of OpenAPI Generator used? 4.2.1
  • Have you search for related issues/PRs?
  • What's the actual output vs expected output?
    Actual: adds all security schemes in middlewares that all get executed.
    Expected: only one security scheme should match.
Description

The generator does not take into account the fact that multiple security schemes are defined as 'OR'. In other words, the generated PHP Slim code will always try to perform all authentication methods simultaneously.

They are added in the middewares like this:

$this->addRoute(..
                $middlewares
            )->setName($operation['operationId']);
openapi-generator version

4.2.1

OpenAPI declaration file content or url
        get:
            ...
            security:
                -
                    AdminToken: []
                -
                    UserJWT: []
                -
                    ExternalToken: []
Steps to reproduce

Create an OpenApi operation with multiple possible security schemes.

Related issues/PRs

Looks similar to https://github.com/OpenAPITools/openapi-generator/issues/3844 for Python. Also https://github.com/OpenAPITools/openapi-generator/issues/797 seems relavant.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the PHP Slim4 generator and the OpenAPI operation containing AdminToken, UserJWT, and ExternalToken security schemes. Inspect how generated route middleware is assembled around addRoute and compare the generated behavior with the OpenAPI OR semantics. Done means only one applicable authentication scheme is required rather than all schemes being executed together.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi, php
Domain
api, authentication, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.