swagger-api / swagger-api/swagger.io-docs

Multiple Authentication "OR" case not working correctly

Open
#324 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Astro
Stars
1.6k
Forks
407
Avg merge
2m
Merged PRs (30d)
2

Description

following the example here my schema.yml has:

 security:
   - basicAuth: []
   - ApiKeyAuth: []
     ...
 securitySchemes:
     basicAuth:
       type: http
       scheme: basic
     ApiKeyAuth:
       type: apiKey
       in: header
       name: X-Internal-x-Authorization-Token

According to the documentation my 'security' section should allow for either Basic authentication or an API key authentication, but there is no configuration option as far as I see (except for using the debug_auth_names flag) to avoid using 'Basic' and use only 'ApiKeyAuth' ("X-Internal-x-Authorization-Token") in my request. Bellow is the auto-generated code. Both authentication methods are added to auth_names, and update_params_for_auth! iterates on both and adds them both to my request header.

my header:

header_params = {Hash[5]} {Content-Type: application/js…, User-Agent: OpenAPI-Genera…, … 3 more}
 "Content-Type" => "application/json"
 "User-Agent" => "OpenAPI-Generator/0.0.40/ruby"
 "X-Internal-x-Authorization-Token" => "<some_hidden_value>"
 "Accept" => "application/json"
 "Authorization" => "Basic <some_other_value>"

auto-generated code:

    def transform_with_http_info(opts = {})
...
      auth_names = opts[:debug_auth_names] || ['ApiKeyAuth', 'basicAuth']
...
data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
def call_api(http_method, path, opts = {})
...
      request = build_request(http_method, path, opts)
def build_request(http_method, path, opts = {})
 update_params_for_auth! header_params, query_params, opts[:auth_names]

opts[:auth_names] -> ['ApiKeyAuth', 'basicAuth']

def update_params_for_auth!(header_params, query_params, auth_names)
      Array(auth_names).each do |auth_name|
        auth_setting = @config.auth_settings[auth_name]
        next unless auth_setting
        case auth_setting[:in]
        when 'header' then header_params[auth_setting[:key]] = auth_setting[:value]
        when 'query'  then query_params[auth_setting[:key]] = auth_setting[:value]
        else fail ArgumentError, 'Authentication token must be in `query` or `header`'
        end
      end
    end
def auth_settings
      {
        'ApiKeyAuth' =>
          {
            type: 'api_key',
            in: 'header',
            key: 'X-Internal-x-Authorization-Token',
            value: api_key_with_prefix('ApiKeyAuth')
          },
        'basicAuth' =>
          {
            type: 'basic',
            in: 'header',
            key: 'Authorization',
            value: basic_auth_token
          },
      }
    end
    def basic_auth_token
      'Basic ' + ["#{username}:#{password}"].pack('m').delete("\r\n")
    end

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the multiple-authentication section at swagger.io/docs/specification/authentication/#multiple and compare its example with the reported schema.yml and generated Ruby methods update_params_for_auth! and auth_settings. Confirm whether the documentation or generated behavior is at fault, then update the relevant documentation so the expected OR behavior and client configuration are explicit.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.