How to use the Security Addon

[EvilWatermelon]

Hi,

I added the SecurityAddon trait but I still don't have to add an API key. How can I enforce it for every endpoint?
I used the todo-actix example to implement the Swagger UI.

[juhaku]

Add to each path separately

utoipa/examples/todo-actix/src/main.rs

Lines 50 to 58 in 67f04b3

	impl Modify for SecurityAddon {
	fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
	let components = openapi.components.as_mut().unwrap(); // we can unwrap safely since there already is components registered.
	components.add_security_scheme(
	"api_key",
	SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("todo_apikey"))),
	)
	}
	}

In the above code at the line 54

utoipa/examples/todo-actix/src/main.rs

Line 54 in 67f04b3

"api_key",

Must match to the api_key value on a #[utoipa::path(..)]

utoipa/examples/todo-actix/src/todo.rs

Lines 139 to 155 in 67f04b3

	#[utoipa::path(
	responses(
	(status = 200, description = "Todo deleted successfully"),
	(status = 401, description = "Unauthorized to delete Todo", body = ErrorResponse, example = json!(ErrorResponse::Unauthorized(String::from("missing api key")))),
	(status = 404, description = "Todo not found by id", body = ErrorResponse, example = json!(ErrorResponse::NotFound(String::from("id = 1"))))
	),
	params(
	("id", description = "Unique storage id of Todo")
	),
	security(
	("api_key" = [])
	)
	)]
	#[delete("/todo/{id}", wrap = "RequireApiKey")]
	async fn delete_todo(id: Path<i32>, todo_store: Data<TodoStore>) -> impl Responder {
	let mut todos = todo_store.todos.lock().unwrap();
	let id = id.into_inner();

Add to whole API via OpenApi security field

However you can add the api_key requirement manually for the whole API by manually adding it to:

utoipa/utoipa/src/openapi.rs

Line 107 in 67f04b3

pub security: Option<Vec<SecurityRequirement>>,

You can also use the #[derive(OpenApi)] macro to add the security requirement for the whole API as defined here https://docs.rs/utoipa/latest/utoipa/openapi/security/struct.SecurityRequirement.html#examples-1