How to make an endpoint require on an AND basis multiple security definitions?

user_11272124 0
Viewed 49

Imagine having an endpoint that both requires an access token, and an api key in the form of a request header.

Currently I've outlined the two security definitions for the endpoint, but the UI recognizes them on a "OR" basis - meaning if either of the two is filled, it's good.

I'd like to change that to be on an AND basis, so that when an endpoint in question requires those two authorizations - both need to be defined in order to work.

Thank you!

swagger-ui swagger swashbuckle .net-core c#
1 Answers

Instead of declaring two separate OpenApiSecurityRequirement objects, simply declare one, and inside the dictionary - include the two securities.

For example:

operation.Security = new List<OpenApiSecurityRequirement>
{
    new OpenApiSecurityRequirement
    {
        [ apiKeyScheme ] = Array.Empty<string>(),
        [ bearerTokenScheme ]  = Array.Empty<string>()
    }
};

(any key-value pair inside there is applied on a AND basis), instead of

operation.Security = new List<OpenApiSecurityRequirement>
{
    new OpenApiSecurityRequirement
    {
        [ apiKeyScheme ] = Array.Empty<string>()
    },
    new OpenApiSecurityRequirement
    {
        [ bearerTokenScheme ]  = Array.Empty<string>()
    }
};

Basically separate requirements are applied via an OR clause, whereas a requirement itself applies the securities inside of it with an AND clause.

user_112721240
Related