Update security.md

[darrelmiller]

Fix security examples as the security property is an array.

[kevinswiber]

@darrelmiller I think this also needs to be fixed on lines 58, 142, and 188.

[kevinswiber]

@darrelmiller Just one little hiccup. Otherwise, LGTM!

[karenetheridge]

"defaultApiKey" is not one of the valid entries for a securityScheme. The schema currently only allows for one of: apiKey, http, mutualTLS, oauth2, openIdConnect.

[kevinswiber]

"defaultApiKey" is not one of the valid entries for a securityScheme. The schema currently only allows for one of: apiKey, http, mutualTLS, oauth2, openIdConnect.

@karenetheridge I believe this is the name in the Security Requirement Object, which must correspond to a name in #/components/securitySchemes. The example shows a Security Scheme Object in Components that's called defaultApiKey, so I think this might be correct.

[karenetheridge]

Aha, my confusion came from "The name used for each property MUST correspond to a security scheme declared in the Security Schemes under the Components Object." -- which I interpreted as the type, not the property name under components.

[handrews]

@karenetheridge

Aha, my confusion came from "The name used for each property MUST correspond to a security scheme declared in the Security Schemes under the Components Object." -- which I interpreted as the type, not the property name under components.

Ah, good catch. The wording could perhaps be something like "The name used for each property MUST correspond to the name of a property under the securitySchemes field of the Components Object."

[mikekistler]

Looks good. 👍