Redocly / Redocly/redocly-cli

Digest Authorization header have bigger priority despite it described before another authorization

Open
#2,124 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

p2 Respect Type: Bug
Dominant language
TypeScript
Stars
1.5k
Forks
228
Avg merge
1d 14h
Merged PRs (30d)
48

Description

Describe the bug

Digest Authorization header has higher priority despite being described before another authorization type.
So if this type of Authorization is used, it always overrides the last Authorization header.

To Reproduce

Steps to reproduce the behavior:

  1. Given this x-security description:
   x-security:
     - scheme:
         type: http
         scheme: digest
       values:
         username: $inputs.name
         password: secret
     - scheme:
         type: apiKey
         name: Authorization
         in: header
       values:
         value: $inputs.secret
  1. When respect executed, digest auth header override API-Key header, although it should have bigger priority
Expected behavior

x-security header resolution should follow top-to-bottom order, with the bottom entry having higher priority.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the respect entry point and the x-security header-resolution logic, then reproduce the supplied configuration to observe the digest and API-key ordering. Verify that entries are resolved top to bottom with the bottom entry taking priority, and add or update the relevant regression test if the existing test structure identifies one.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi, typescript
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.