OpenAPITools / OpenAPITools/openapi-generator

[BUG] bearerAuth security scheme not resulting in access_token being used to create Authorization header.

Open
#18,041 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description

Having generated a Python client from an OpenAPI spec including the following securityscheme:

  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

It is not possible to use the access_token configuration parameter in the resulting client. Passing it to openapi_client.Configuration on instantiation, or adding it to the instantiated object, does not result in the Authorization header being passed in requests.

openapi-generator version

7.3.0

OpenAPI declaration file content or url
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
Generation Details
docker run --rm \
  -v ${PWD}:/local openapitools/openapi-generator-cli generate \
  -i /local/myspecification.yaml \
  -g python \
  -o /local/client
Steps to reproduce
"""Testing the OpenAPI client."""

import openapi_client
from openapi_client.rest import ApiException
from pprint import pprint


configuration = openapi_client.Configuration(
    host="https://myapi.com/v2.5.6"
    access_token="my_token"
)


configuration.debug = True

configuration.access_token = "my_token"


with openapi_client.ApiClient(
    configuration,
) as api_client:
    api_instance = openapi_client.DefaultApi(api_client)

    try:
        api_response = api_instance.get_building_by_id(20)
        pprint(api_response)
    except ApiException as e:
        print("Exception when calling DefaultApi->get_building_by_id: %s\n" % e)

Debug output:

send: b'GET /v2.5.6/buildings/20 HTTP/1.1\r\nHost: myapi.com\r\nAccept-Encoding: identity\r\nAccept: application/json\r\nUser-Agent: OpenAPI-Generator/1.0.0/python\r\n\r\n'
Related issues/PRs

Seems related:

https://github.com/OpenAPITools/openapi-generator/issues/8865

But stated fix of setting saccess_token after instantiation of the configuration class doesn't appear to work. And the issue says it was fixed in v6. Indeed, configuration.py in the generated code does seem to include the requisite fixes:

self.access_token = access_token
        """Access token
        """

...

    def auth_settings(self):
        """Gets Auth Settings dict for api client.

        :return: The Auth Settings information dict.
        """
        auth = {}
        if self.access_token is not None:
            auth['bearerAuth'] = {
                'type': 'bearer',
                'in': 'header',
                'format': 'JWT',
                'key': 'Authorization',
                'value': 'Bearer ' + self.access_token
            }
        return auth
Suggest a fix

I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth'].

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the generated Python client's configuration.py, especially auth_settings, and trace how ApiClient uses those settings when building requests. Use the supplied bearerAuth specification and reproduction to check why the Authorization header is absent, then verify that requests include the Bearer token when access_token is configured.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi, python
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.