Support cookie based security validation?

[tkarls]

I have an API and added both Bearer token authentication as well as support for sessions with cookies. But now the openapi validater never ever complain about missing credentials if I have them both listed in the security array.

It works as expected when I only use bearer auth (getting 401 and error message if no bearer token is present). But as soon as I add the cookie based auth to the security array the validator doesn't complain about missing tokens or missing cookies for that matter.

It took me a while to pinpoint but I think the problem is that cookie auth was never implemented and then it always treat that as successful even if no cookie is present. See below.

express-openapi-validator/src/middlewares/openapi.security.ts

Line 246 in 03ba8d6

// TODO scheme in cookie

[cdimascio]

@tkarls Yep. We need to get this implemented.
Would you mind providing the relevant snippet from your API spec

[cdimascio]

initial cookie auth support: b7d7afc

[cdimascio]

@tkarls please give v3.12.5 a try. let me know if suits your needs.

[cdimascio]

@tkarls this is fixed in the latest version, please re-open if you still have issues. Thank you!

[tkarls]

@cdimascio Wow, this was quick 😁

I will test the latest version during the day!
Many thanks!

[tkarls]

@cdimascio
I have tested it in my project now and it works!
Only small thing left would be that it only returns the error of the first validation that failed. So if I don't send in any cookie nor any token I get an error message that complains about only one of them (the first that failed) which is the first I list in the openapi spec.

Which is different from other request validations where I get an array of all errors encountered back.

However, since with the auth errors it is sufficient to have ONE of them correct it might not be the best approach to return them as an array either. Since that can be interpreted as all of them need to be fulfilled.

Anyway, the important thing is that the validation is working. So thanks again for your rapid fix :) !

[cdimascio]

thanks @tkarls. i'll create a ticket for the errors. will be good to have the same representation