Repository navigation
Security requirement not serialized correctly #2300
Description
Describe the bug
I'm migrating Swashbuckle.AspNetCore to Microsoft.OpenApi 2.0.0-preview7 (as that's the version used by ASP.NET Core 10 preview 2), and an existing regression test we have for OAuth2 is failing due to the security definition not being deserialized correctly.
Distilling things down, this is what we expect:
{
"openapi": "3.0.4",
"info": { },
"paths": { },
"components": {
"securitySchemes": {
"oauth2": {
"type": "oauth2",
"flows": {
"authorizationCode": {
"authorizationUrl": "/auth-server/connect/authorize",
"tokenUrl": "/auth-server/connect/token",
"scopes": {
"readAccess": "Access read operations",
"writeAccess": "Access write operations"
}
}
}
}
}
},
"security": [
{
"oauth2": [
"readAccess",
"writeAccess"
]
}
]
}However, what we get is this:
{
"openapi": "3.0.4",
"info": { },
"paths": { },
"components": {
"securitySchemes": {
"oauth2": {
"type": "oauth2",
"flows": {
"authorizationCode": {
"authorizationUrl": "/auth-server/connect/authorize",
"tokenUrl": "/auth-server/connect/token",
"scopes": {
"readAccess": "Access read operations",
"writeAccess": "Access write operations"
}
}
}
}
}
},
"security": [
{ }
]
}As far as I can tell, the Target is returning null (so nothing is emitted), but I don't understand why it isn't found via the reference into the host document:
It might be that there's an additional code migration I need to do here for v2, but if there is I haven't been able to spot it.
OpenApi File To Reproduce
[Fact]
public void CanSerializeSecuritySchemes()
{
var document = new OpenApiDocument();
document.Components ??= new();
document.Components.SecuritySchemes.Add("oauth2", new OpenApiSecurityScheme
{
Type = SecuritySchemeType.OAuth2,
Flows = new OpenApiOAuthFlows
{
AuthorizationCode = new OpenApiOAuthFlow
{
AuthorizationUrl = new Uri("/auth-server/connect/authorize", UriKind.Relative),
TokenUrl = new Uri("/auth-server/connect/token", UriKind.Relative),
Scopes = new Dictionary<string, string>
{
{ "readAccess", "Access read operations" },
{ "writeAccess", "Access write operations" }
}
}
}
});
document.SecurityRequirements.Add(new OpenApiSecurityRequirement
{
{
new OpenApiSecuritySchemeReference("oauth2", document),
["readAccess", "writeAccess"]
}
});
using var writer = new StringWriter();
var jsonWriter = new OpenApiJsonWriter(writer);
document.SerializeAsV3(jsonWriter);
var json = writer.ToString();
}Expected behavior
The security scheme and the required scopes are serialized to the OpenAPI document.
Activity
RachitMalik12 commentedon Apr 2, 2025
Maggie Kimani (@MaggieKimani1) can you take a look to see if we can reproduce it? It might have been fixed in the latest preview since preview7 was released in Feb.
MaggieKimani1 commentedon Apr 2, 2025
Rachit Malik (@RachitMalik12) I've managed to repro it.
As Martin's mentioned, it's because the Target property in this code line is null hence the serialization logic isn't being executed:
OpenAPI.NET/src/Microsoft.OpenApi/Models/OpenApiSecurityRequirement.cs
Line 76 in 3534a65
Investigating why the Target in the Reference object is not being set.
MaggieKimani1 commentedon Apr 3, 2025
Martin Costello (@martincostello) the Target value above is not being set since the security scheme object hasn't been registered to the document's workspace, which is where reference resolution takes place.
In order for the reference to be resolved and serialized correctly, you can use this method defined on the document to add a specific component to the components object of the current document as well as register it to the underlying workspace.
Here's the updated code snippet that works for your use case:
An alternative would be to add the line below to your test to ensure all components are registered:
martincostello commentedon Apr 3, 2025
Thanks for investigating Maggie Kimani (@MaggieKimani1) - is this something that should be added to #2298?
MaggieKimani1 commentedon Apr 3, 2025
Yes I can update the upgrade guide to reflect this. Feel free to close the issue as it's not a bug.