Repository navigation
fix(theme): dedupe auth scheme reused by OR security alternatives - #1707
Open
CloudCorpRecords wants to merge 1 commit into
Open
CloudCorpRecords wants to merge 1 commit into
CloudCorpRecords wants to merge 1 commit into
Conversation
OR security alternatives that reuse the same scheme collapsed into a single auth option in createAuth, but the scheme was added to that option once per alternative. buildPostmanRequest then emitted the scheme's header (e.g. Authorization) multiple times, which browsers merge into a duplicated header value that JWT APIs reject. Add each scheme to an option at most once, keyed by scheme key. AND combinations of different schemes are unchanged. Fixes PaloAltoNetworks#1703 Signed-off-by: Rene Turcios <95189389+CloudCorpRecords@users.noreply.github.com>
CloudCorpRecords
requested a deployment
to
default
November 4, 2026 17:09 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1703.
When an operation declares multiple OpenAPI
securityalternatives that reuse the same scheme with different scopes (logical OR),createAuthcollapsed them into one auth option (the option id is built only from scheme names) but pushed the scheme into that option once per alternative.buildPostmanRequestthen emitted the scheme's header once per entry, so anapiKeyscheme namedAuthorization(or an http bearer scheme) produced a duplicatedAuthorizationheader that browsers merge intotoken, token, which JWT APIs reject.Fix
In
createAuth(ApiExplorer/Authorization/slice.ts), add each scheme to an option at most once, deduped by schemekey. The first alternative's entry is kept; scopes remain alternatives (OR), not two credentials applied together. AND combinations of different schemes (e.g.BearerAuth and ApiKey) are unchanged, as are distinct OR alternatives.Tests
New
ApiExplorer/Authorization/slice.test.tscovering:apiKeyscheme (the reported repro) produce a single scheme entryBefore the fix the two dedupe tests failed (scheme array length 2); after the fix all pass:
slice.test.ts: 4 passedApiExplorerjest area (--selectProjects default): 6 suites, 183 tests passedSigned-off-by: Rene Turcios 95189389+CloudCorpRecords@users.noreply.github.com