Is there a way to disable security for specific endpoints?

[pheanex]

Description

We want to be able to custom configure security on different paths. (I.e. enable/disable security entirely). As far as I understand from these discussions, this should be possible by providing an empty security-object on a operation object:

• No Security for a sub path OAI/OpenAPI-Specification#1278
• Allow optional anonymous access OAI/OpenAPI-Specification#1684
• Clarify empty Security Requirement Object usage and validity OAI/OpenAPI-Specification#1886

=> It seems that overriding security on operation level does not work as intended, or am I doing something wrong here?

Expected behaviour

When I specify an empty security object on an operation object, I would expect that the application does not require authentication of any kind on this path, as the global security object is overridden.

Actual behaviour

Calling the path still requires authentication and fails.

Steps to reproduce

Specify a global security setting and override it on a operation object and call the application on that endpoint.

Additional info:

Python 3.7.3
Version: 2.2.0

[sochi]

As long as I understand the issue correctly, we are using this functionality already.. which makes me think that your API definition might be incorrect.
Perhaps you could provide content of (or a snippet of) openapi.yaml/swagger.yaml file?

Using the straightforward approach works fine, based on my observations:

  /custom_operation_endpoint/:
    get:
      tags: [CustomTag]
      security: []  # doing this disables the default security for this particular operation
      summary: Write your summary here..
      responses:
        200:
          description: Returns the result..
          schema:
            type: object
            properties:
              ...

(for reference, the usage of security is documented in https://swagger.io/specification/#oasObject)

[pheanex]

Seems like you were right. I was able to disable security on a specific endpoint now.
Can't tell what the issue was though.
=> Thank you