Description
An API requiring authentication should define its scheme in OpenAPI 3.0 components.securitySchemes so clients know which headers or tokens to send. A public API intentionally offering unauthenticated access can omit this definition.
Potential impact
Omitting a required authentication scheme can cause integration failures or misunderstandings about access requirements.
Remediation
Define the actual authentication scheme and its properties in components.securitySchemes, then reference it from global or operation-level security. Configure the server and gateway to enforce the same requirements.
Examples
The example adds a Bearer scheme and security requirement for an API that needs authentication. The server must also be configured to validate tokens.
Before
json
{
"openapi": "3.0.0",
"info": {
"title": "Simple API overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "200 response"
}
}
}
}
}
}
After
json
{
"openapi": "3.0.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "200 response"
}
}
}
}
},
"security": [
{
"exampleSecurity": []
}
],
"components": {
"securitySchemes": {
"exampleSecurity": {
"type": "http",
"scheme": "bearer"
}
}
}
}