Repository navigation
Display scope for non OAuth security schemes #451
Description
Describe the bug
OpenAPI 3.1.0 allows scopes to be defined for security schemes other than OAuth:
- API Key authentication should allow scopes to be defined. OAI/OpenAPI-Specification#1366
- security; widen use of scopes array to other securityScheme types OAI/OpenAPI-Specification#1829
In a case where we define the API spec for endpoints protected by a customized JWT access token, we would expect the access token to define the scopes that the user can access. Although OpenAPI 3.1 is not officially supported by this project, it should be possible to adopt this feature.
Expected behavior
Both of the following securitySchemes should render the scopes under Authorization.
security:
- petstore_auth:
- "write:pets"
- "read:pets"
- api_key:
- "write:pets"
- "read:pets"
securitySchemes:
petstore_auth:
description: |
Get access to data while protecting your account credentials.
OAuth2 is also a safer and more secure way to give you access.
type: oauth2
flows:
implicit:
authorizationUrl: "http://petstore.swagger.io/api/oauth/dialog"
scopes:
"write:pets": modify pets in your account
"read:pets": read your pets
api_key:
description: >
For this sample, you can use the api key `special-key` to test the
authorization filters.
type: apiKey
name: api_key
in: header
Activity
welcome-to-palo-alto-networks commentedon Feb 22, 2023
🎉 Thanks for opening your first issue here! Welcome to the community!
guitaoliu commentedon Feb 22, 2023
Should be fixed by #444. Thanks.