Repository navigation
Incorrect default value for OpenApiSecurityScheme.In when using "http" type with "bearer" scheme #1843
Description
Activity
I am assuming you mean the
Inproperty rather thanLocationas there is no Location property.However, the
Inproperty is only applicable totypeequal toapiKey. It has no impact ontypeequal tohttp. When using thetypehttp, the credentials are always sent in theAuthorizationheader. This is stated explicitly in the description of theschemefield here https://spec.openapis.org/oas/v3.1.0.html#fixed-fields-22- changed the title
[-]Incorrect default value for OpenApiSecurityScheme.Location when using "http" type with "bearer" scheme[/-][+]Incorrect default value for OpenApiSecurityScheme.In when using "http" type with "bearer" scheme[/+]on Oct 2, 2024 Thank you for using the SDK and for reaching out.
I put together #2952
Let me know if you have any additional comments or questions.
Describe the bug
When defining an OpenApiSecurityScheme of type http with the scheme bearer, the default value for In is set to Query instead of Header. According to the OpenAPI Specification, header should be the implied default when the type is http and the scheme is bearer.
OpenApi File To Reproduce
Expected behavior
The default value for OpenApiSecurityScheme.In should be Header when the type is http and the scheme is bearer, aligning with the OpenAPI Specification’s default behavior.
Additional context
This issue causes incorrect behavior when generating clients or code based on the OpenAPI definition, as the security token is expected to be sent as a query parameter instead of the Authorization header.