OpenAPITools / OpenAPITools/openapi-generator
[BUG] PHPSlim4 - Want only 1 authentication method out of multiple
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Bug Report Checklist
- Have you provided a full/minimal spec to reproduce the issue?
- Have you validated the input using an OpenAPI validator (example)?
- What's the version of OpenAPI Generator used? 4.2.1
- Have you search for related issues/PRs?
- What's the actual output vs expected output?
Actual: adds all security schemes in middlewares that all get executed.
Expected: only one security scheme should match.
Description
The generator does not take into account the fact that multiple security schemes are defined as 'OR'. In other words, the generated PHP Slim code will always try to perform all authentication methods simultaneously.
They are added in the middewares like this:
$this->addRoute(..
$middlewares
)->setName($operation['operationId']);
openapi-generator version
4.2.1
OpenAPI declaration file content or url
get:
...
security:
-
AdminToken: []
-
UserJWT: []
-
ExternalToken: []
Steps to reproduce
Create an OpenApi operation with multiple possible security schemes.
Related issues/PRs
Looks similar to https://github.com/OpenAPITools/openapi-generator/issues/3844 for Python. Also https://github.com/OpenAPITools/openapi-generator/issues/797 seems relavant.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the PHP Slim4 generator and the OpenAPI operation containing AdminToken, UserJWT, and ExternalToken security schemes. Inspect how generated route middleware is assembled around addRoute and compare the generated behavior with the OpenAPI OR semantics. Done means only one applicable authentication scheme is required rather than all schemes being executed together.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi, php
- Domain
- api, authentication, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100