Authorization header does not set when auth is optional about scalar HOT 4 OPEN

Thanks for the report! I don’t have the chance to check it right now, but my gut tells me it’s not related to the parser error.

from scalar.

Finally got time to look at this! Thanks for the report.

This is happening because the API defintion has an empty object {} in the security array:

"security": [
  {
    "cookieAuth": []
  },
  {
    "basicAuth": []
  },
+  {}
],

According to the OpenAPI 3.0.3 specification, this makes authentication optional:

To make security optional, an empty security requirement ({}) can be included in the array.

Source: https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.3.md#operation-object

And if no authentication is required, we don't add it to the example request. Personally, I think that’s fine. What do you think @marclave?

Here is a sandbox without the empty object:
https://sandbox.scalar.com/e/lIISF

from scalar.

I'll fix $ref, but it works fine in swagger.

from scalar.

@hanspagel Thank you for your analysis. I intended authentication to be optional in that case. Please consider adding an authentication header. I wish that it could be added by entering the authentication header value.

Reference

• tfranzel/drf-spectacular#99 (comment)

from scalar.