Skip to content

🐛 0.120.3 breaks SecurityBase based dependencies in OpenAPI #14271

@tiangolo

Description

@tiangolo

Edit: Added as an issue for completeness and history.

Discussed in #14263

Originally posted by oldfielj-ansto October 31, 2025

First Check

  • I added a very descriptive title here.
  • I used the GitHub search to find a similar question and didn't find it.
  • I searched the FastAPI documentation, with the integrated search.
  • I already searched in Google "How to X in FastAPI" and didn't find any information.
  • I already read and followed all the tutorial in the docs and didn't find an answer.
  • I already checked if it is not related to FastAPI but to Pydantic.
  • I already checked if it is not related to FastAPI but to Swagger UI.
  • I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

  • I commit to help with one of those options 👆

Example Code

from uvicorn import run
from fastapi import FastAPI, Depends
from fastapi.security import OpenIdConnect


_oidc = OpenIdConnect(
    openIdConnectUrl="https://localhost/auth/realms/test/.well-known/openid-configuration",
)

app = FastAPI(
    title="My Application",
    docs_url="/swagger",
    redoc_url="/docs",
    openapi_url="/openapi.json",
    dependencies=(Depends(_oidc),),
)


@app.get("/")
async def hello_world():
    return {"Hello": "World"}


if __name__ == "__main__":
    run(app=app, port=8080)

Description

Under FastAPI 0.120.2

Under FastAPI 0.120.3

As well as testing Depends I have tested with Security to declare the dependency, which results in the same behavior.

What I'd expect is that FastAPI 0.120.3 displays consistent behavior with FastAPI 0.120.2, when defining a security dependency, and that the "Authorize" button and padlock icon on the root endpoint would be displayed in the auto generated Swagger documentation.

It would seem that in 0.120.3, the security section of the generated openapi.json file is omitted.

Under FastAPI 0.120.2

{
  "openapi": "3.1.0",
  "info": {
    "title": "My Application",
    "version": "0.1.0"
  },
  "paths": {
    "/": {
      "get": {
        "summary": "Hello World",
        "operationId": "hello_world__get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {}
              }
            }
          }
        },
        "security": [
          {
            "OpenIdConnect": []
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "OpenIdConnect": {
        "type": "openIdConnect",
        "openIdConnectUrl": "https://localhost/auth/realms/test/.well-known/openid-configuration"
      }
    }
  }
}

Under FastAPI 0.120.3

{
  "openapi": "3.1.0",
  "info": {
    "title": "My Application",
    "version": "0.1.0"
  },
  "paths": {
    "/": {
      "get": {
        "summary": "Hello World",
        "operationId": "hello_world__get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {}
              }
            }
          }
        }
      }
    }
  }
}

If this behavior is expected, and I'm doing something wrong here, please let me know.

Thank you.

Operating System

Linux

Operating System Details

Ubuntu 24.04

FastAPI Version

0.120.3

Pydantic Version

2.12.3

Python Version

Python 3.13.8

Additional Context

Swagger UI - FastAPI 0.120.2

Screenshot from 2025-10-31 11-02-46

Swagger UI - FastAPI 0.120.3

Screenshot from 2025-10-31 11-03-47

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions