Description
In OpenAPI 2.0, non-OAuth2 schemes such as basic and apiKey do not take scopes in security requirements. Adding scopes to their entries in security makes the definition inconsistent with the authentication scheme.
Potential impact
Document validation may fail, or API users may assume that the authentication scheme provides scope-based access control.
Remediation
For a scheme whose type is basic or apiKey, use an empty array [] for its name in security. If scopes are needed, define and reference an OAuth2 scheme that matches the authorization server's configuration.
Examples
The example only corrects the scope array for Basic authentication. An empty array does not disable authentication.
Before
yaml
swagger: "2.0"
security:
- petstore_auth:
- write
- read
securityDefinitions:
petstore_auth:
type: basic
After
yaml
swagger: "2.0"
security:
- petstore_auth: []
securityDefinitions:
petstore_auth:
type: basic