我正在使用 Swagger Core 2.0 生成 openAPI 3.0 定义文件并且
我无法禁用特定端点的“安全性”。
我定义了 securitySchemes 和根安全元素:
{
"openapi" : "3.0.1",
"security" : [ {
"JWT" : [ ]
} ],
"paths" : {
"/auth" : {
"post" : {
"summary" : "authenticate user",
"operationId" : "authenticate",
"requestBody" : {
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/AuthenticationRequest"
}
}
}
},
"responses" : {
"200" : {
"description" : "when user is successfully authenticated",
"content" : {
"application/json" : {
"schema" : {
"$ref" : "#/components/schemas/AuthenticateUserOutput"
}
}
}
},
"401" : {
"description" : "when email/password not valid or user is blocked/inactive"
}
}
}
},
},
"components" : {
"schemas" : {
"AuthenticateUserOutput" : {
"type" : "object",
"properties" : {
"token" : {
"type" : "string"
},
"lastLoginAt" : {
"type" : "string",
"format" : "date-time"
},
"lastProjectId" : {
"type" : "string"
}
}
},
...,
"AuthenticationRequest" : {
"required" : [ "email", "password" ],
"type" : "object",
"properties" : {
"email" : {
"type" : "string"
},
"password" : {
"type" : "string"
}
}
}
},
"securitySchemes" : {
"JWT" : {
"type" : "http",
"scheme" : "bearer",
"bearerFormat" : "JWT"
}
}
}
}
根据 OPEN API 3 规范 https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.1.md#securityRequirementObject 我应该能够覆盖个人的全局“安全要求”手术。我想“禁用”一些操作的 JWT 安全性,根据 https://github.com/OAI/OpenAPI-Specification/blob/3.0.1/versions/3.0.1.md#securityRequirementObject 可以完成:
To remove a top-level security declaration, an empty array can be used.
不幸的是,我正在努力使用注释在操作级别定义“空安全数组”... 我试图指定
security = {}
或
security = @SecurityRequirement(name ="")
但是操作中根本没有生成任何安全元素...... 任何想法 ?
下面是我的 java 代码(我用于 swagger dropwizard 集成),它允许定义 SecurityScheme 和根级别安全性
Info info = new Info()
.title("someTitle")
.description("some description")
.version("1.0")
SecurityScheme jwtSecurity = new SecurityScheme()
.type(SecurityScheme.Type.HTTP)
.name("Authorization")
.in(SecurityScheme.In.HEADER)
.scheme("bearer")
.bearerFormat("JWT");
String securitySchemaName = "JWT";
OpenAPI oas = new OpenAPI()
.info(info)
.components(new Components().addSecuritySchemes(securitySchemaName, jwtSecurity))
.addSecurityItem(new SecurityRequirement().addList(securitySchemaName));
SwaggerConfiguration oasConfig = new SwaggerConfiguration()
.openAPI(oas)
.prettyPrint(true)
.resourcePackages(Stream.of("my.resources.package")
.collect(Collectors.toSet()));
environment.jersey().register(new OpenApiResource()
.openApiConfiguration(oasConfig));
然后在一些专用端点上我想禁用安全性,所以我正在尝试:
@POST
@Operation(
summary = "authenticate user",
responses = {
@ApiResponse(responseCode = "200", description = "when user is successfully authenticated",
content = @Content(schema = @Schema(implementation = AuthenticateUserOutput.class))),
@ApiResponse(responseCode = "401", description = "when email/password not valid or user is blocked/inactive"),
}
,security = what to put here ?
)
最佳答案
如果你想以 yml swagger hub 风格来做,你可以放
security: []
在请求正文之后的该端点中,因此 swagger 认为它没有对该特定路径或端点进行身份验证。
关于java - swagger core 2.0 禁用端点安全性,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/50640517/