Description

matheuslc

opened on Nov 10, 2022

Issue body actions

What?

I'm using a bearer security scheme and I want to authenticate some endpoints but there are some of them I don't want, for example, the login endpoint that I use to get the JWT token.

Do you folks know how can I handle that?

Also, is there a way to skip a path to be generated? As I couldn't figure out how to have non-authenticated endpoints, my next option would be not to use the generated code to implement the login endpoint. But it turns out, that the only to do that right now is to remove the definitions from my openapi file, what is terrible for my documentation and tests cases :(

Many thanks!

Reacted by Ryan Hartje

Activity

1. jamietanna commented on Nov 12, 2022

   

   jamietanna

   on Nov 12, 2022

   Member

   More actions

   I've done this before with oapi-codegen (v1.11.x) and it should still be viable - do you have an OpenAPI spec to share?

   I.e. the following that uses a default of HTTP Basic auth, but allows excluding the auth per-endpoint:

   security:
     - basic: []
   paths:
     "/health":
       get:
         description: Healthcheck endpoint
         operationId: healthcheck
         security: []
         responses:
           '200':
             description: Service is healthy
             content: {}
     "/crash":
       get:
         description: Crash endpoint to test monitoring
         operationId: crash
         # lack of `security` ensures it defaults to auth
   components:
     securitySchemes:
       basic:
         type: http
         scheme: basic
2. matheuslc commented on Nov 14, 2022

   

   matheuslc

   on Nov 14, 2022

   Author

   More actions

   @jamietanna many thanks for your answers!

   When I asked this question, I was a bit hasty, so it turns out that there is some context missing. I was trying to use the Echo JWT Middleware . I have been using this middleware to validate the JWT of my requests. I was struggling to add it to the generated server.

   Usually, we separate the endpoints that will use the JWT middleware or not through echo groups, which I can't have using oapi-codegen.

   Reading more the examples founder, I figure out we need to write our own function to validate it, like here: https://github.com/deepmap/oapi-codegen/blob/master/examples/authenticated-api/echo/server/jwt_authenticator.go

   Is there a way to use the Echo JWT middleware? 🤔 Is it a good idea to add a way to generate echo groups? If you think it's worth it, I can provide some options to implement that.

   Here is the Open API spec: https://github.com/matheuslc/go-social-graph/blob/main/openapi/openapi.yml
   Here is the generated server: https://github.com/matheuslc/go-social-graph/blob/main/server/server.gen.go

   Meanwhile, I've removed the Echo JWT middleware and am now validating my JWT through the authenticate func. This way, it correctly only requires JWT token where I'm declaring a security field on Open API.

   Again, many thanks! I'm really enjoying this library!

   Reacted by Danny Rottstegge
3. mromaszewicz commented on Feb 7, 2026

   

   mromaszewicz

   on Feb 7, 2026

   Member

   More actions

   This is supported via the OpenAPI security spec. Use security: [] on individual operations to exclude them from authentication. See the authenticated-api example. Closing as answered.

   Reacted by Daniel S
4. mromaszewicz

   closed this as not plannedon Feb 7, 2026

Issue actions