Skip to content

Display scope for non OAuth security schemes #451

@guitaoliu

Description

@guitaoliu

Describe the bug

OpenAPI 3.1.0 allows scopes to be defined for security schemes other than OAuth:

In a case where we define the API spec for endpoints protected by a customized JWT access token, we would expect the access token to define the scopes that the user can access. Although OpenAPI 3.1 is not officially supported by this project, it should be possible to adopt this feature.

Expected behavior

Both of the following securitySchemes should render the scopes under Authorization.

security:
  - petstore_auth:
      - "write:pets"
      - "read:pets"
  - api_key: 
      - "write:pets"
      - "read:pets"

securitySchemes:
    petstore_auth:
      description: |
        Get access to data while protecting your account credentials.
        OAuth2 is also a safer and more secure way to give you access.
      type: oauth2
      flows:
        implicit:
          authorizationUrl: "http://petstore.swagger.io/api/oauth/dialog"
          scopes:
            "write:pets": modify pets in your account
            "read:pets": read your pets
    api_key:
      description: >
        For this sample, you can use the api key `special-key` to test the
        authorization filters.
      type: apiKey
      name: api_key
      in: header

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions