liveBook · Manning

OpenAPI security field

As explained in Secure APIs

An OpenAPI security field is a specification field that assigns security requirements globally or to an individual API operation.

An OpenAPI security field records which API operations require authentication or authorization. The top-level field applies a requirement across the API; an operation-level field can override it for one HTTP operation. section 8.1

Protect most endpoints, leave one public

A ride-sharing API can declare JWTBearer under a global security field. The /protected-hello operation then inherits that requirement, while /hello sets security: [] to remain anonymous. The security scheme itself belongs under components.securitySchemes. section 8.1

Figure 8.1 We define the security schemes that protect our API in the specification’s components section under securitySchemes, and we apply them globally to the API under the specification’s security field or per operation using the operation’s security field.
figure

Use the figure to trace the relationship between securitySchemes definitions and global or per-operation security fields. section 8.1

Check the design before implementing it:

  • Decide which operations need protection and whether user groups require different access. section 8.1
  • Validate access tokens on every request and enforce operation permissions in server middleware. section 8.7

How Secure APIs covers it

How deep it goes
Defines global and operation-level application, but leaves token validation and authorization enforcement to implementation.
Examples
Uses a ride-sharing API, a JWTBearer scheme, and anonymous /hello versus protected /protected-hello operations.
What it assumes
Assumes decisions about protected operations and user types, while introducing security schemes and their placement from the specification structure.
What you can do after
Apply it via OpenAPI by protecting the API globally and overriding selected operations with explicit security settings.
How it connects
Connects OpenAPI security schemes with authentication, authorization, JWT bearer tokens, and role-based access control.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.