For validation of request with security schemes are there any default options.AuthenticationFunc

[shivanshudixit16]

For validation of request with security schemes are there any default options.AuthenticationFunc or do we need to explicitly pass our own Authentication Function check through RequestValidationInput as done in the tests. Was not able to find any examples or documentation regarding that.

[fenollp]

The default is the noop defined at

kin-openapi/openapi3filter/validation_handler.go

Line 10 in 26e9a37

func NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }

For a more involved example take a look at

kin-openapi/openapi3filter/validation_test.go

Lines 598 to 614 in 5f67f43

	AuthenticationFunc: func(c context.Context, input *AuthenticationInput) error {
	if schemesValidated != nil {
	if validated, ok := (*schemesValidated)[input.SecurityScheme]; ok {
	if validated {
	t.Fatalf("The path %q had the schemes %v named %q validated more than once",
	path.name, input.SecurityScheme, input.SecuritySchemeName)
	}
	(*schemesValidated)[input.SecurityScheme] = true
	return nil
	}
	}
	t.Fatalf("The path %q had the schemes %v named %q",
	path.name, input.SecurityScheme, input.SecuritySchemeName)
	return nil
	},

Of course if you can share your own implementations the community as a whole would profit. :)

[shivanshudixit16]

Thanks ! I am facing issue when i have security set as "api_key" for the swagger pet API example . It fails even if I pass api_key in header , But as per NoopAuthenticationFunc implementation It should not fail, I am just using the code in the README.md i.e, not passing any options.AuthenticationFunc. So I was curious why it was failing .Getting this error panic: Security requirements failed .
But it works successfully if I passs something like

   requestValidationInput := &openapi3filter.RequestValidationInput{
	Request:    httpReq,
	PathParams: pathParams,
	Route:      route,
	Options: &openapi3filter.Options{
		AuthenticationFunc: func(c context.Context, input *openapi3filter.AuthenticationInput) error {
			return nil
		},
	},
}

[fenollp]

Indeed I was wrong: the func is unset in DefaultOptions and so fail-safe. The API consumer must define their own func if they have defined security requirements.
I am mentioning this in the docs.
Thanks!