Azure / Azure/azure-functions-openapi-extension
Server path is removed in oauth2 redirect
- Dominant language
- C#
- Stars
- 388
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
According to the [swagger spec](https://swagger.io/docs/specification/api-host-and-base-path/), swagger can be configured to use a Server url and have all of the API endpoints made relative to that base URL. They state that a server url can include scheme, host, port and path.
So, if my API has the routes:
/eat
/drink
/sleep
, and no api prefix,
I should be able to configure swagger with the server url https://my.domain/**v1.0**, resulting in the endpoints:
https://my.domain/v1.0/eat
https://my.domain/v1.0/drink
https://my.domain/v1.0/sleep
or with server url http://localhost:123, resulting in the endpoints:
http://localhost:123/eat
http://localhost:123/drink
http://localhost:123/sleep
Unfortunately the azure-functions-openapi-extension SwaggerUI AddServer code truncates the path from any Servers urls, resulting in only the _scheme_, _host_ and _port_ being used.
In my case, this makes it impossible for me to get the OAuth security flows to work when my API is served from an API gateway which includes a path in it's url.
**To Reproduce**
1. Proxy your API behind an API Gateway, such as apigee or Azure API Management Services, and configure the API gateway with a url that includes a path.
2. Test an OAuth flow such as an oauth2 implicit flow
3. Observe that the oauth2_redirect.html page request is absent the server url's path.
**Expected behavior**
Server url path should be included in the oauth2_redirect.html endpoint address.
Contributor guide
Research direction
Start by tracing the SwaggerUI AddServer code described in the issue and inspect how the oauth2_redirect.html endpoint is built from a Server URL. Reproduce the behavior with a server URL containing a path, then verify that the generated redirect endpoint preserves that path while scheme, host, and port continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, openapi
- Domain
- api, authentication, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100