CLI call to openapi-spec with security in path fails

Type: Bug
Since: 1.8.0

Description:
The CLI call php-openapi validate example.spec.json fails due to the fact that the security in path is transformed to a list of arrays and not a list of objects in

php-openapi/src/spec/SecurityRequirements.php

Line 64 in 893ab10

$data[] = [$name => $securityRequirement->getSerializableData()];

Minimal example.spec.json to reproduce:

{
  "openapi": "3.0.0",
  "info": {
    "title": "My API",
    "version": "1, 2"
  },
  "paths": {
    "/v1/users/profile": {
      "get": {
        "operationId": "V1GetUserProfile",
        "summary": "Returns the user profile",
        "responses": {
          "200": {
            "description": "dummy"
          }
        },
        "security": [
          {
            "test_test": ["test:scope:foo"]
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "test_test": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "https://example.com/openid-connect/auth",
            "tokenUrl": "https://example.com/openid-connect/token",
            "scopes": {
              "test:scope:foo": "test_scope"
            }
          }
        }
      }
    }
  }
}

I'll provide a MR with test case and a fix if you like.

Fix cebe#242

Thanks for reporting.

This issue is fixed in PR #239

Commit: SOHELAHMED7@f669fef

Commit containing test: 6d5bde9

@SOHELAHMED7

Hi @SOHELAHMED7

I use this library to verify and merge yaml files into a single openapi yaml file. I have two security schemes as stated in example source below.

In most cases, I expect two of this security schemes to be used together (logical conjunction).

Since v1.8.0 this is broken and in generated yaml file only apiKey is used, ignores second one and bearerAuth is missing completely in endpoint definitions.

Example source yaml:

openapi: 3.0.0
info:
  title: API Documentation
  description: All API endpoints are presented here.
  version: 1.0.0
servers:
  - url: http://127.0.0.1:8080/

paths:

  /endpoint:
    get:
      responses:
        '200':
          description: OK
      security:
        - apiKey: []
          bearerAuth: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-APi-Key
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT Authorization header using the Bearer scheme.

Generated output:

openapi: 3.0.0
info:
  title: 'API Documentation'
  description: 'All API endpoints are presented here.'
  version: 1.0.0
servers:
  -
    url: 'http://127.0.0.1:8080/'
paths:
  /endpoint:
    get:
      responses:
        '200':
          description: OK
      security:
        -
          apiKey: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      name: X-APi-Key
      in: header
    bearerAuth:
      type: http
      description: 'JWT Authorization header using the Bearer scheme.'
      scheme: bearer
      bearerFormat: JWT

Fix cebe#242 (comment)

@mkorkmaz

@mkorkmaz

Thanks for reporting.

This issue is fixed in 7b5f3da and 19fabbc (PR #239).

I have already added test for above scenario and I will add more of other scenarios

@cebe

@cebe

PR #239 can be added to milestone 1.9.0

We have the same issue, maybe release a patch? :-/

@cebe

bump, if you guide me into the direction @cebe i can send a PR

Navigation Menu

Repository navigation

CLI call to openapi-spec with security in path fails #242

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

CLI call to openapi-spec with security in path fails #242

Description

Activity

SOHELAHMED7 commented on May 15, 2025

mkorkmaz commented on May 16, 2025

SOHELAHMED7 commented on May 17, 2025

SOHELAHMED7 commented on May 19, 2025

nadar commented on Jun 5, 2025

nadar commented on Sep 3, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions