can't use SkipRequestBodyEncodeDecode and authentification at the same time about goa HOT 7 OPEN

OK I found I can use 'Header' to map the APIKey payload, but it seems that it should not have been necessary.

from goa.

Some APIs use query string parameters for API keys so Goa can't assume it is a header.

from goa.

OK, but if I don't specify anything, it does automatically use a header. However the check in SkipRequestBodyEncodeDecode does not consider it was mapped in this case.

from goa.

Ah sorry I had missed the point about the default behavior. That is indeed inconsistent - reopening :)

from goa.

I tried to reproduce this issue but wasn't able to, the following works as expected:

package design

import . "goa.design/goa/v3/dsl"

// APIKeyAuth defines a security scheme that uses API keys.
var APIKeyAuth = APIKeySecurity("api_key", func() {
	Description("Secures endpoint by requiring an API key.")
})

var _ = Service("foo", func() {
	Method("bar", func() {
		Security(APIKeyAuth)
		Payload(func() {
			APIKey("api_key", "key")
		})
		HTTP(func() {
			POST("/")
			SkipRequestBodyEncodeDecode()
		})
	})
})

If you are still seeing the issue can you please provide a design that reproduces it?

from goa.