openapi-spec-validator
openapi-spec-validator copied to clipboard
Validation of required fields inconsistent
The validation of the required keyword does not make sense as it is implemented right now, IMHO.
- It really does not make any sense to list properties in
requiredthat do not exist. - If you want to use it with
allOfand therefore have properties inrequiredthat do not exist, there are already precautions (#154). - Currently, there is no validation error in the standard case but as soon as I have
allOfin my schema, there is a validation error. That is inconsistent. The PR that breaks it: #312 - In
$referenced schemas, the validation does not take effect either.
One of the main reasons why this should urgently be validated (as was in version 0.7.0) is that validators (that use the specification to validate requests/responses) will fail if there is e.g. a typo in one of the entries in required. And now there is no way to detect that.
In general, the OpenAPI/JsonSchema specification is quite relaxed. If only the bare minimum should be validated, this is probably not the only validation that can basically be removed completely.
My take on this:
- Best case: Throw validation errors for things that are obvious errors (like specifying a field as required that does not even exist).
- Second best option: make it configurable ("strict mode") or filterable (error IDs to exclude, filter levels, ...).
- Absolutely necessary minium: make it consistent.
I'd be willing to provide a PR. But since this has been going back and forth I'd like a decision first, where this is going.