Validate security spec of an operation

We noticed that security spec of an operation isn't validated against top level securityDefinitions. e.g. if we have the following top level securityDefinitions and a security definition on an operation.

{
    "securityDefinitions": {
        "Bearer": {
            "type": "apiKey",
            "name": "Authorization",
            "in": "header",
            "description": "Authentication by Bearer token"
        }
    },
    "paths": {
        "/hello": {
            "get": {
                "security": [{
                    "Bearer": []
                }]
            }
        }
    }
}

calling GET /hello without an Authorisation header is validated.

Comments (4)