Digest Authorization header have bigger priority despite it described before another authorization
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.5k
- Forks
- 228
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 48
Description
Describe the bug
Digest Authorization header has higher priority despite being described before another authorization type.
So if this type of Authorization is used, it always overrides the last Authorization header.
To Reproduce
Steps to reproduce the behavior:
- Given this
x-securitydescription:
x-security:
- scheme:
type: http
scheme: digest
values:
username: $inputs.name
password: secret
- scheme:
type: apiKey
name: Authorization
in: header
values:
value: $inputs.secret
- When
respectexecuted, digest auth header override API-Key header, although it should have bigger priority
Expected behavior
x-security header resolution should follow top-to-bottom order, with the bottom entry having higher priority.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the respect entry point and the x-security header-resolution logic, then reproduce the supplied configuration to observe the digest and API-key ordering. Verify that entries are resolved top to bottom with the bottom entry taking priority, and add or update the relevant regression test if the existing test structure identifies one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi, typescript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100