Azure / Azure/azure-functions-openapi-extension
Bug Report: Oauth2 Redirect Url malformed
- Dominant language
- C#
- Stars
- 388
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
I have an a Durable Task Azure function I created in vs2022, using Microsoft.Azure.WebJobs.Extensions.OpenApi v1.3.0
I configured OpenAPI to use OpenApiVersionType.V3. When I try to Authorize the swagger client, I get the prompt asking for the Client Id and Scope I requested, I provide those, it routes me to Microsoft, but the redirectUrl provided to microsoft is wrong:
redirect_uri=http%3A%2F%2Flocalhost%3A5800https%3A%2F%2Flocalhost%3A5800%2Fapi%2Foauth2-redirect.html
It appears to be combining 2 full absolute urls:
http://localhost:5800 + https://localhost:5800/api/oauth2-redirect.html
Why does it do this? Is there some configuration option to fix this, or override this behavior?
My function is decorated with this attribute:
`[OpenApiSecurity("function_key", SecuritySchemeType.OAuth2, Flows = typeof(AzureFunctionOauthSecurityFlows),In = OpenApiSecurityLocationType.Header)]
`
```
public class AzureFunctionOauthSecurityFlows : OpenApiOAuthFlows
{
public AzureFunctionOauthSecurityFlows()
{
var scopesDictionary = new Dictionary();
scopesDictionary.Add("scope here", "");
Implicit = new OpenApiOAuthFlow()
{
AuthorizationUrl = new Uri("https://login.microsoftonline.com/ID_HERE/oauth2/v2.0/authorize"),
TokenUrl = new Uri("https://login.microsoftonline.com/ID_HERE/oauth2/v2.0/token"),
Scopes = scopesDictionary
};
}
}
```
Contributor guide
Research direction
Start by reproducing the OAuth2 authorization flow with the shown OpenApiSecurity attribute and AzureFunctionOauthSecurityFlows configuration in an Azure Functions app. Trace where the authorize request constructs redirect_uri and compare it with the two URLs shown in the report. Done means identifying the source of the malformed URL and documenting or verifying the applicable configuration or behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, openapi
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100