Disable security for one operation

Hi, I have a @OpenAPIDefinition with security defined for the whole app, but I want to override and disable security for one method, how can I do that? Using @Operation(security = {}) on the method doesn’t seem to work. Expected output in yaml is security: [] for that one operation.

Thanks

[mafor]

Hi,

I came across this issue recently. I found a workaround using OpenApiCustomiser, but I would prefer a proper solution. I think it is doable without changes to the swagger-core annotations (not with the Operation annotation, but with an ‘empty’ SecurityRequirements). It would look like this:

@RestController
public class AuthenticationController {

    @PostMapping(value = "/login", consumes = MediaType.APPLICATION_JSON_VALUE)
    @SecurityRequirements(value = {}) // <- or without 'value', added for clarity
    public JwtAuthenticationResponse createAuthenticationToken(
        @RequestBody JwtAuthenticationRequest authenticationRequest) {
   }
}

It doesn’t work out of the box, there are some changes needed in the SecurityParser Would you mind if I sent you a PR?

[bnasslahsen]

Yeah @mafor, i wasn’t sure about your feedback. Anyway, the important is that its now shared with the community.