Maybe we could get rid of our operation filters in favor of the mattfrear/Swashbuckle.AspNetCore.Filters

[VictorioBerra]

https://github.com/mattfrear/Swashbuckle.AspNetCore.Filters/tree/master/src/Swashbuckle.AspNetCore.Filters

There are some overlap here, maybe we could consolidate? Either PR our filters to them or remove ours in favor of theirs?

[RehanSaeed]

Yes, I see what you mean. The difference is that the .NET Boxed code checks the authorization requirement type and adds either 401 or 403 responses according to what makes sense. The Swashbuckle code blindly adds the responses everywhere. I think we could submit a PR fixing that. We could also add a PR for the schema filters.

[VictorioBerra]

Yeah I saw that, I think most people need both 401/403 all the time anyways but its good to have the option for just a 401. Especially because I don't think you would ever have a 403 without also having a 401.

[RehanSaeed]

401 - You don't have access at all.
403 - You have some access but not enough to call the operation.

It's totally possible and quite common to have 401 without 403.

[RehanSaeed]

Had another look at the code and it's still blindly adding both responses. I'm going to upgrade our code.