Open titpetric opened 2 years ago
https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#fixed-fields-7 lists a finite set of HTTP verbs and PURGE (nor CONNECT) isn't part of it.
I am not against a mechanism to support custom HTTP verbs for de/serialization and validation, just this should be behind a config flag that defaults to not accepting these.
Note: this is handled today but should be under such a config flag: https://github.com/getkin/kin-openapi/blob/e95ed3471cf52fb8df78cbf0f374d6b83d412b2d/openapi3/path_item.go#L20
Servers like nginx, varnish, squid implement custom http verbs, specifically PURGE. This request method is also supported by Postman, curl and most modern client implementations support custom verbs (net/http stdlib too)