OpenAPITools / OpenAPITools/openapi-generator
[BUG] bearerAuth security scheme not resulting in access_token being used to create Authorization header.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Bug Report Checklist
- Have you provided a full/minimal spec to reproduce the issue?
- Have you validated the input using an OpenAPI validator (example)?
- Have you tested with the latest master to confirm the issue still exists?
- Have you searched for related issues/PRs?
- What's the actual output vs expected output?
- [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description
Having generated a Python client from an OpenAPI spec including the following securityscheme:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
It is not possible to use the access_token configuration parameter in the resulting client. Passing it to openapi_client.Configuration on instantiation, or adding it to the instantiated object, does not result in the Authorization header being passed in requests.
openapi-generator version
7.3.0
OpenAPI declaration file content or url
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
Generation Details
docker run --rm \
-v ${PWD}:/local openapitools/openapi-generator-cli generate \
-i /local/myspecification.yaml \
-g python \
-o /local/client
Steps to reproduce
"""Testing the OpenAPI client."""
import openapi_client
from openapi_client.rest import ApiException
from pprint import pprint
configuration = openapi_client.Configuration(
host="https://myapi.com/v2.5.6"
access_token="my_token"
)
configuration.debug = True
configuration.access_token = "my_token"
with openapi_client.ApiClient(
configuration,
) as api_client:
api_instance = openapi_client.DefaultApi(api_client)
try:
api_response = api_instance.get_building_by_id(20)
pprint(api_response)
except ApiException as e:
print("Exception when calling DefaultApi->get_building_by_id: %s\n" % e)
Debug output:
send: b'GET /v2.5.6/buildings/20 HTTP/1.1\r\nHost: myapi.com\r\nAccept-Encoding: identity\r\nAccept: application/json\r\nUser-Agent: OpenAPI-Generator/1.0.0/python\r\n\r\n'
Related issues/PRs
Seems related:
https://github.com/OpenAPITools/openapi-generator/issues/8865
But stated fix of setting saccess_token after instantiation of the configuration class doesn't appear to work. And the issue says it was fixed in v6. Indeed, configuration.py in the generated code does seem to include the requisite fixes:
self.access_token = access_token
"""Access token
"""
...
def auth_settings(self):
"""Gets Auth Settings dict for api client.
:return: The Auth Settings information dict.
"""
auth = {}
if self.access_token is not None:
auth['bearerAuth'] = {
'type': 'bearer',
'in': 'header',
'format': 'JWT',
'key': 'Authorization',
'value': 'Bearer ' + self.access_token
}
return auth
Suggest a fix
I can't seem to trace down the code which is ignoring the auth_settings. There appears to be no other code that references auth['bearerAuth'].
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the generated Python client's configuration.py, especially auth_settings, and trace how ApiClient uses those settings when building requests. Use the supplied bearerAuth specification and reproduction to check why the Authorization header is absent, then verify that requests include the Bearer token when access_token is configured.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi, python
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100