Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow specifying global security schema for all routes #222

Open
richiksc opened this issue Jun 14, 2022 · 3 comments
Open

Allow specifying global security schema for all routes #222

richiksc opened this issue Jun 14, 2022 · 3 comments
Labels
enhancement New feature or request

Comments

@richiksc
Copy link

richiksc commented Jun 14, 2022

Is your feature request related to a problem? Please describe.
Currently, specifying a security schema happens on a per-route basis with the @security annotation. Swagger allows specifying one security schema globally for all routes, e.g. https://swagger.io/docs/specification/authentication/bearer-authentication/

Describe the solution you'd like
Allow specifying a global list of security schemas in the configuration object, or marking security schemas defined in security as global, e.g.

{
    security: {
        BearerAuth:  {
            type: 'http',
            scheme: 'bearer',
            global: true,
        }
    },
}
@richiksc
Copy link
Author

It looks like actually by default, Swagger will apply security schemes defined in the security block to all routes globally, unless overridden on a per-route basis. express-jsdoc-swagger correctly declares the security scheme in the security block but then overrides the security scheme by passing "security": [] on each route without an @security annotation, overriding the default top-level security.

@richiksc
Copy link
Author

Would have been fixed by #179.

@kevinccbsg
Copy link
Member

🤔 I see your point. Right now, it is only configurable per route. Adding a global one might be a good idea but not all the API uses global, so we should keep both options. We will think about it.

We want to add a better security definition for Oauth2 so we will consider this in that development.

@kevinccbsg kevinccbsg added the enhancement New feature or request label Jul 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants