grpc-ecosystem/grpc-gateway · error

malformed security requirement spec for key

Error message

malformed security requirement spec for key %q; value is required

What it means

Spec-validation error in renderServices while converting google.api SecurityRequirement protos: a security requirement map entry has a nil value, but the OpenAPI spec requires each scheme key to map to a (possibly empty) list of scopes. The offending input is the SecurityRequirement in the openapiv2 options whose value was not set.

Solutions

1. Set an (optionally empty) scopes list for every key in the security requirement.
2. Remove the empty entry from the openapiv2_security options if the scheme is not needed.

When it happens

Trigger: Thrown at protoc-gen-openapiv2/internal/genopenapi/template.go:2533 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of grpc-ecosystem/grpc-gateway@a58a4436a3 (2026-09-02). Data as JSON: /api/errors/dac30aa1947598a3. Report an issue: GitHub.

Appendix: source

Thrown at protoc-gen-openapiv2/internal/genopenapi/template.go:2533

					exts, err := processExtensions(secDefValue.Extensions)
					if err != nil {
						return nil, err
					}
					newSecDefValue.extensions = exts
				}
				s.SecurityDefinitions[secDefKey] = newSecDefValue
			}
		}
		if spb.Security != nil {
			var newSecurity []openapiSecurityRequirementObject
			if s.Security != nil {
				newSecurity = s.Security
			}
			for _, secReq := range spb.Security {
				newSecReq := openapiSecurityRequirementObject{}
				for secReqKey, secReqValue := range secReq.SecurityRequirement {
					if secReqValue == nil {
						return nil, fmt.Errorf("malformed security requirement spec for key %q; value is required", secReqKey)
					}
					newSecReqValue := make([]string, len(secReqValue.Scope))
					copy(newSecReqValue, secReqValue.Scope)
					newSecReq[secReqKey] = newSecReqValue
				}
				newSecurity = append(newSecurity, newSecReq)
			}
			s.Security = newSecurity
		}
		s.ExternalDocs = protoExternalDocumentationToOpenAPIExternalDocumentation(spb.ExternalDocs, p.reg, spb)
		// Populate all Paths with Responses set at top level,
		// preferring Responses already set over those at the top level.
		if spb.Responses != nil {
			for _, verbs := range s.Paths {
				var maps []openapiResponsesObject
				if verbs.PathItemObject.Delete != nil {
					maps = append(maps, verbs.PathItemObject.Delete.Responses)
				}

View on GitHub (pinned to a58a4436a3)