Operation overrides global security with empty array

Hello !

I noticed that when an operation overrides the global security with an empty array, thus specifying that no security should be applied on this operation, it still somehow tries to validate the access to the route (and throws an error).

More specifically, and according to https://swagger.io/docs/specification/authentication/, if an operation has (e.g.)

...
security:
  - ApiKeyAuth: []
  - OAuth2:
      - read
      - write
paths:
  /ping:
    get:
      security: []   # No security

The route should be accessible publicly.

Currently, from what I see, it throws the default error. From what I checked, I think the check here should additionally check if the schemes array is empty or not. Doing so will bypass the security when the array is empty.

if (!schemes ||  schemes.length === 0) {

What do you think ? I’m open to do a MR for this

This could be seen as a breaking change, as if some people using the lib have “badly” configured security rules in their Open API specs and were happy with this default handler, it will suddenly change “badly configured” protected routes to unprotected routes

[mhamann]

For anyone using v2 of this lib, you can do something like this as a workaround:

security:
  - none: []
 
paths:
  /ping:
    get:
      security:
        - none

and then provide a security handler that’s basically a no-op:

const securityHandlers = {
  none: async function () {
    // No-op
  }
}

[seriousme]

btw:

if (!(schemes?.length > 0)) {

would work as well 😉

Kind regards, Hans