operation-security-defined (Swagger 2.0 linter rule)

operation-security-defined

Since 0.9.0

This rule checks whether every operation of a Swagger 2.0 document is covered by a security requirement.

Rule Details

Swagger 2.0 declares security schemes under securityDefinitions and applies them with security requirements, either at the root of the document (for every operation) or on individual operations. An operation without any requirement is documented as publicly accessible, which is often an oversight.

When the root security list is not empty, every operation is covered and the rule reports nothing. Otherwise the operation-security-defined rule reports Security requirement is not defined for every operation whose own security list is missing or empty. An explicit security: [] on an operation is reported as well.

Configuration

None.

Examples

Good. The root security requirement applies to every operation.

swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  apiKey:
    type: apiKey
    name: X-API-Key
    in: header
security:
  - apiKey: []
paths:
  /pets:
    get:
      responses:
        '200':
          description: A list of pets.

Good. Each operation declares its own security requirement.

swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  basic:
    type: basic
paths:
  /pets:
    get:
      security:
        - basic: []
      responses:
        '200':
          description: A list of pets.

Bad. There is no root security requirement and the post operation has none of its own.

swagger: '2.0'
info:
  title: Pet Store
  version: 1.0.0
securityDefinitions:
  basic:
    type: basic
paths:
  /pets:
    get:
      security:
        - basic: []
      responses:
        '200':
          description: A list of pets.
    post:
      responses:
        '201':
          description: The pet was added.

When Not to Use It

You may disable this rule for public APIs, or disable it on the individual operations that are intentionally public.

Compatibility

This rule is compatible with Swagger 2.0 documents. OpenAPI 3.x documents are linted by the OpenAPI linter, which has a rule of the same name.