search

discord-gophers / goapi-gen

This package contains a set of utilities for generating Go boilerplate code for services based on OpenAPI 3.0 API definitions
Apache License 2.0
132 stars 12 forks source link

Verify security requirements before other parts of spec #69

Closed zacharyburkett closed 2 years ago

zacharyburkett commented 2 years ago

Currently the goapi-gen request validation middleware performs security checks after other checks. This can result in getting a 400 error before a 401 when unauthed. Expected behavior is no other data would be returned if I'm unauthed.

Line in question https://github.com/discord-gophers/goapi-gen/blob/main/pkg/middleware/oapi_validate.go#L74

This can be fixed by calling openapi3filter.ValidateSecurityRequirements first in our middleware.