# operation-security-defined

Source: https://apigenie.pl/docs/linter/swagger/rules/operation-security-defined

This rule checks whether every operation of a Swagger 2.0 document is covered
by a security requirement.

## Rule Details

Swagger 2.0 declares security schemes under `securityDefinitions` and applies
them with `security` requirements, either at the root of the document (for
every operation) or on individual operations. An operation without any
requirement is documented as publicly accessible, which is often an oversight.

When the root `security` list is not empty, every operation is covered and the
rule reports nothing. Otherwise the `operation-security-defined` rule reports
`Security requirement is not defined` for every operation whose own `security`
list is missing or empty. An explicit `security: []` on an operation is
reported as well.

## Configuration

None.

## Examples

**Good**. The root security requirement applies to every operation.

```yaml
swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  apiKey:
    type: apiKey
    name: X-API-Key
    in: header
security:
  - apiKey: []
paths:
  /pets:
    get:
      responses:
        '200':
          description: A list of pets.
```

**Good**. Each operation declares its own security requirement.

```yaml
swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  basic:
    type: basic
paths:
  /pets:
    get:
      security:
        - basic: []
      responses:
        '200':
          description: A list of pets.
```

**Bad**. There is no root security requirement and the `post` operation has
none of its own.

```yaml
swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  basic:
    type: basic
paths:
  /pets:
    get:
      security:
        - basic: []
      responses:
        '200':
          description: A list of pets.
    post:
      responses:
        '201':
          description: The pet was added.
```

## When Not to Use It

You may disable this rule for public APIs, or disable it on the individual
operations that are intentionally public.

## Compatibility

This rule is compatible with Swagger 2.0 documents. OpenAPI 3.x documents are
linted by the OpenAPI linter, which has a rule of the same name.