-
Notifications
You must be signed in to change notification settings - Fork 283
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
OpenAPI 3.1.0 allows scopes to be defined for security schemes other than OAuth:
- API Key authentication should allow scopes to be defined. OAI/OpenAPI-Specification#1366
- security; widen use of scopes array to other securityScheme types OAI/OpenAPI-Specification#1829
In a case where we define the API spec for endpoints protected by a customized JWT access token, we would expect the access token to define the scopes that the user can access. Although OpenAPI 3.1 is not officially supported by this project, it should be possible to adopt this feature.
Expected behavior
Both of the following securitySchemes should render the scopes
under Authorization
.
security:
- petstore_auth:
- "write:pets"
- "read:pets"
- api_key:
- "write:pets"
- "read:pets"
securitySchemes:
petstore_auth:
description: |
Get access to data while protecting your account credentials.
OAuth2 is also a safer and more secure way to give you access.
type: oauth2
flows:
implicit:
authorizationUrl: "http://petstore.swagger.io/api/oauth/dialog"
scopes:
"write:pets": modify pets in your account
"read:pets": read your pets
api_key:
description: >
For this sample, you can use the api key `special-key` to test the
authorization filters.
type: apiKey
name: api_key
in: header
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working