Authorization header does not set in CDN mode.

[channprj]

What happens?

Authorization header doesn't set in CDN mode.

I think it's related with $ref issue.

What did you expect to happen?

How can we reproduce the issue?

1. Deploy with CDN
2. Send request
3. Authorization does not set

OpenAPI Document

https://sandbox.scalar.com/e/G8yz4

[channprj]

I'll fix $ref, but it works fine in swagger.

[hanspagel]

Thanks for the report! I don’t have the chance to check it right now, but my gut tells me it’s not related to the parser error.

[hanspagel]

Finally got time to look at this! Thanks for the report.

This is happening because the API defintion has an empty object {} in the security array:

"security": [
  {
    "cookieAuth": []
  },
  {
    "basicAuth": []
  },
+  {}
],

According to the OpenAPI 3.0.3 specification, this makes authentication optional:

To make security optional, an empty security requirement ({}) can be included in the array.

Source: https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#operation-object

And if no authentication is required, we don't add it to the example request. Personally, I think that’s fine. What do you think @marclave?

Here is a sandbox without the empty object:
https://sandbox.scalar.com/e/lIISF

[channprj]

@hanspagel Thank you for your analysis. I intended authentication to be optional in that case. Please consider adding an authentication header. I wish that it could be added by entering the authentication header value.

Reference

• Documentation for Authentication tfranzel/drf-spectacular#99 (comment)