Security requirements object is confusing

[OJFord]

What's the motivation for having:

security:
  - scheme1: []
  - scheme2: []

rather than:

security:
  scheme1: []
  scheme2: []

which seems more straightforward, and easier to parse?

As it is, when encountering a security object, we have a list of maps containing just a single key - only we don't know what that key is. (Python-ish, as it happens) pseudocode:

for scheme in security:
    scheme_id = scheme.keys().pop()
    scopes = scheme[scheme_id]
    // ...

versus:

for (scheme_id, scopes) in security:
    // ...

[darrelmiller]

The reason for this extra layer is because the security property is a list of security requirement objects that can actually have multiple keys to indicate that multiple schemes must be satisfied to authorize.

e.g.

security:
  - scheme1: []
    scheme2: []
  - scheme3: []

This would mean, that you can either use scheme1 AND scheme2 OR use just scheme3. The schemes are always defined in /components/securitySchemes

[OJFord]

Ah! Thank you for clarifying that @darrelmiller, that makes a lot of sense. 👍