Azure / Azure/azure-functions-openapi-extension

Bug Report: Oauth2 Redirect Url malformed

Open
#419 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
388
Forks
202
PR merge metrics
No merged PRs in 30d

Description

I have an a Durable Task Azure function I created in vs2022, using Microsoft.Azure.WebJobs.Extensions.OpenApi v1.3.0
I configured OpenAPI to use OpenApiVersionType.V3. When I try to Authorize the swagger client, I get the prompt asking for the Client Id and Scope I requested, I provide those, it routes me to Microsoft, but the redirectUrl provided to microsoft is wrong:

redirect_uri=http%3A%2F%2Flocalhost%3A5800https%3A%2F%2Flocalhost%3A5800%2Fapi%2Foauth2-redirect.html

It appears to be combining 2 full absolute urls:

http://localhost:5800 + https://localhost:5800/api/oauth2-redirect.html

Why does it do this? Is there some configuration option to fix this, or override this behavior?

My function is decorated with this attribute:

`[OpenApiSecurity("function_key", SecuritySchemeType.OAuth2, Flows = typeof(AzureFunctionOauthSecurityFlows),In = OpenApiSecurityLocationType.Header)]
`

```
public class AzureFunctionOauthSecurityFlows : OpenApiOAuthFlows
{

public AzureFunctionOauthSecurityFlows()
{

var scopesDictionary = new Dictionary();
scopesDictionary.Add("scope here", "");

Implicit = new OpenApiOAuthFlow()
{
AuthorizationUrl = new Uri("https://login.microsoftonline.com/ID_HERE/oauth2/v2.0/authorize"),
TokenUrl = new Uri("https://login.microsoftonline.com/ID_HERE/oauth2/v2.0/token"),
Scopes = scopesDictionary
};


}
}
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the OAuth2 authorization flow with the shown OpenApiSecurity attribute and AzureFunctionOauthSecurityFlows configuration in an Azure Functions app. Trace where the authorize request constructs redirect_uri and compare it with the two URLs shown in the report. Done means identifying the source of the malformed URL and documenting or verifying the applicable configuration or behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, openapi
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.