Multiple OR and AND security requirements and side effects

[pkriens]

Just asked a question on https://stackoverflow.com/questions/42679595/swagger-openapi-multiple-security-requirements-and-side-effects but then thought this might be a better place.

When implementing the specification I am not sure how to handle multiple security requirements that are OR and AND. Generally, a failed security requirement has side effects, for example OAuth2 needs to redirect and basic authentication need to set a header and result code.

However, which one of the security requirements to pick?

[LasneF]

The concern will be managed in this more recent ticket
#4119