Azure / Azure/azure-functions-openapi-extension

Server path is removed in oauth2 redirect

Open
#562 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
388
Forks
202
PR merge metrics
No merged PRs in 30d

Description

According to the [swagger spec](https://swagger.io/docs/specification/api-host-and-base-path/), swagger can be configured to use a Server url and have all of the API endpoints made relative to that base URL. They state that a server url can include scheme, host, port and path.

So, if my API has the routes:
/eat
/drink
/sleep

, and no api prefix,

I should be able to configure swagger with the server url https://my.domain/**v1.0**, resulting in the endpoints:
https://my.domain/v1.0/eat
https://my.domain/v1.0/drink
https://my.domain/v1.0/sleep

or with server url http://localhost:123, resulting in the endpoints:
http://localhost:123/eat
http://localhost:123/drink
http://localhost:123/sleep

Unfortunately the azure-functions-openapi-extension SwaggerUI AddServer code truncates the path from any Servers urls, resulting in only the _scheme_, _host_ and _port_ being used.

In my case, this makes it impossible for me to get the OAuth security flows to work when my API is served from an API gateway which includes a path in it's url.

**To Reproduce**
1. Proxy your API behind an API Gateway, such as apigee or Azure API Management Services, and configure the API gateway with a url that includes a path.
2. Test an OAuth flow such as an oauth2 implicit flow
3. Observe that the oauth2_redirect.html page request is absent the server url's path.

**Expected behavior**
Server url path should be included in the oauth2_redirect.html endpoint address.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the SwaggerUI AddServer code described in the issue and inspect how the oauth2_redirect.html endpoint is built from a Server URL. Reproduce the behavior with a server URL containing a path, then verify that the generated redirect endpoint preserves that path while scheme, host, and port continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, openapi
Domain
api, authentication, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.