Can I exclude a route from security?

[DaGLiMiOuX]

Hi there, again!

I've been reading this discussion which I found useful as I want to inform our third parties that they have to authenticate through /api/login before continuing with future requests. As docs says, the problem is that EVERY request has to be authenticated.

It would be nice that the plugin checks routes/api.php routes in order to know which routes are protected or to allow us to customize the security function/scheme in order to set which routes are excluded or included in security. Actually, I didn't find anything related in docs or in PHP files, so I dont know if that is possible right now.

Btw, would be nice that generated docs didn't show Authentication header if not fullfilled, show a <Required value> text or something like that. Right know shows undefined.

Thanks for your time and effort! 👍

Best regards,
D.

[romalytvynenko]

Hey @DaGLiMiOuX

I'm on it (allowing unauthenticated routes).

About the rendered docs and <Required value>. This is a nice idea, but I use third party library to render the docs. So unless I fork, or make a PR to that lib, or start my UI lib it is not possible to make changes to the UI.

Thanks.

[romalytvynenko]

Hey @DaGLiMiOuX

Starting from 0.4.0 you can do that!

Simply add @unauthenticated PhpDoc annotation to route's method you would like to exclude from security requirements.

Here is a doc: https://scramble.dedoc.co/usage/security#excluding-a-route-from-security-requirements

🙌