Goa can already generate support for HTTP Authorization: Bearer <token>, but today that support is only available through JWTSecurity. This makes it awkward to model APIs that accept opaque Bearer tokens. These APIs are not JWT-specific, but their Goa designs still need to use JWT terminology in the DSL and the generated auth hooks. As a result, the implementation ends up exposing JWT-specific names even when the public OpenAPI contract is just standard HTTP Bearer authentication.
It would be useful to have a BearerSecurity DSL for modeling generic Bearer authentication without JWT-specific terminology. Ideally, this would also include matching Bearer token payload helpers.
For OpenAPI v3, BearerSecurity should generate:
type: httpscheme: bearerbearerFormat only when the design explicitly sets one
BearerSecurity and JWTSecurity could share the same default HTTP wire format:
Authorization: Bearer <token>
The main difference would be semantic and reflected in the generated names. BearerSecurity would generate Bearer-oriented hooks for generic or opaque Bearer tokens, while JWTSecurity would continue to generate JWT-oriented hooks for designs that explicitly model JWT Bearer tokens.
Goa can already generate support for HTTP
Authorization: Bearer <token>, but today that support is only available throughJWTSecurity. This makes it awkward to model APIs that accept opaque Bearer tokens. These APIs are not JWT-specific, but their Goa designs still need to use JWT terminology in the DSL and the generated auth hooks. As a result, the implementation ends up exposing JWT-specific names even when the public OpenAPI contract is just standard HTTP Bearer authentication.It would be useful to have a
BearerSecurityDSL for modeling generic Bearer authentication without JWT-specific terminology. Ideally, this would also include matching Bearer token payload helpers.For OpenAPI v3,
BearerSecurityshould generate:type: httpscheme: bearerbearerFormatonly when the design explicitly sets oneBearerSecurityandJWTSecuritycould share the same default HTTP wire format:Authorization: Bearer <token>The main difference would be semantic and reflected in the generated names.
BearerSecuritywould generate Bearer-oriented hooks for generic or opaque Bearer tokens, whileJWTSecuritywould continue to generate JWT-oriented hooks for designs that explicitly model JWT Bearer tokens.