Version

5.0.0

Context

We use web-openapi-router to manage our endpoints, and we use a sidecar that handles all authentication. This means that we want to disable the OpenAPI security features. Using the RouterBuilders setDoSecurity(false) solved the first issue that prevented creation.
Now the bug appears (as I see it), when a request is sent through the Router. The ChainAuthHandler is empty as a result of disabling security, but a ChainAuthHandler is not allowed to be empty (ChainAuthHandlerImpl) without throwing an exception.

This leads me to believe the solution is a simple check, either via introducing isEmpty on the ChainAuthHandler interface, or the somewhat smaller fix, to adjust the AuthenticationHandlers class with small boolean:

    final ChainAuthHandler authHandler;
    boolean emptyAuthHandler = true;

    switch (securityRequirements.size()) {
      [....]
      default:
        authHandler = ChainAuthHandler.any();
        securityRequirements
          .stream()
          .map(securityRequirement -> and(route, securityRequirement, failOnNotFound))
          .filter(Objects::nonNull)
          .forEach(handler -> {
              authHandler.add(handler);
              emptyAuthHandler = false;
          });
    }

    if (emptyAuth || emptyAuthHandler) {
      authHandler
        .add(ANONYMOUS_SUCCESS_AUTH_HANDLER);
    }

    return authHandler;