Description
If securityDefinitions is absent or empty in OpenAPI 2.0, the document defines no authentication schemes. An API that uses authentication should describe the mechanism and credentials it requires. An intentionally public API may need no authentication definition.
Potential impact
Missing definitions leave developers and client generators without the information needed to supply credentials. An omission in the specification does not establish that the server lacks authentication.
Remediation
Define the actual authentication scheme in securityDefinitions, then reference it in global or operation-level security. Defining a scheme alone does not apply an authentication requirement. Enforce the requirement on the server as well.
Examples
The example defines ApiKeyAuth and requires it throughout the API.
Before
{
"swagger": "2.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"summary": "List API versions",
"responses": {
"200": {
"description": "ok"
}
}
}
}
},
"securityDefinitions": {}
}
After
{
"swagger": "2.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"summary": "List API versions",
"responses": {
"200": {
"description": "ok"
}
}
}
}
},
"securityDefinitions": {
"ApiKeyAuth": {
"type": "apiKey",
"in": "header",
"name": "X-API-Key"
}
},
"security": [
{
"ApiKeyAuth": []
}
]
}