Undefined OAuth2 scope in operation security requirements

Description

In OpenAPI 2.0, an operation's security requirement misstates its required permissions when it references a scope missing from the corresponding OAuth2 scheme in securityDefinitions.

Potential impact

Clients may request tokens with the wrong scope, or developers may implement the operation's permission requirements incorrectly.

Remediation

Compare each operation's scope names with the scheme's scopes and correct typos or outdated references. Define required permissions to match the authorization server. Operation-level security replaces the global setting, so retain all necessary requirements when making the correction.

Examples

The example removes the unnecessary error:api scope from the operation and retains read:api. If error:api is required, add its definition first.

Before

yaml

swagger: "2.0"
paths:
  /:
    get:
      security:
        - oAuth2AuthCode:
            - read:api
            - error:api
securityDefinitions:
  oAuth2AuthCode:
    type: oauth2
    flow: accessCode
    authorizationUrl: https://api.example.com/oauth/authorize
    tokenUrl: https://api.example.com/oauth/token
    scopes:
      read:api: read your apis

After