OpenApi requestBody does not enforce format password

[BernardA]

API Platform version(s) affected: 3.1.4

Description

I am manually creating an operation with OpenApiFactory for an authentication route. The intention is that the password should be masked when the user inputs it on Swagger UI, but that's not the case. It treats it as an ordinary string, no masking.

The corresponding openapi documentation is in this link.

How to reproduce

On /OpenApi/OpenApiFactory

   $schemas['Auth'] = new ArrayObject([
        'type' => 'object',
        'properties' => [
            'email' => [
                'type' => 'string',
                'format' => 'email',
                'readOnly' => false,
            ],
            'password' => [
                'type' => 'string',
                'format' => 'password',
                'readOnly' => false,
            ],
        ],
    ]);

   content: new ArrayObject([
                    'application/json' => [
                        'schema' => [
                            '$ref' => '#/components/schemas/Auth',
                        ],
                    ],
                ]),

The format attribute works fine for the email field or if I apply any other format to the password field, like ( date, date-time).

Note that the same password attribute works fine, meaning it masks the user input, when used in the context of a GET operation parameter, as below:

    new Parameter(
            name: 'password',
                   schema: [
                         'type' => 'string', 
                         'format' => 'password'                      
                     ],
                    description: '<p>Password in the format <code>10 digits</code></p>',
                    in: 'body'
                 )
            ],

Possible Solution

Additional Context

[soyuka]

The schema and the Parameter schema aren't related, you may need to specify this elsewhere no?

[BernardA]

Thanks @soyuka . I just mentioned the code for Parameter to illustrate what works there. I am aware that those are different things but, at the same time, the result should be the same, ie, the password should be masked.

[soyuka]

I don't think that swagger UI reads the schema

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.