OpenAPITools / OpenAPITools/openapi-generator

[BUG][C#][csharp-netcore] Authentication doesn't work if there are multiple security definitions

Open
#3,714 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Client: C-Sharp Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • What's the version of OpenAPI Generator used?
  • Have you search for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Bounty to sponsor the fix (example)
Description

When generating a client using the csharp-netcore generator with a targetFramework of netcoreapp2.0, if there are multiple security definitions in the input json:

    "securityDefinitions": {
        "Authorization Code": {
            "flow": "accessCode",
            "authorizationUrl": "http://localhost:8080/uaa/oauth/authorize",
            "tokenUrl": "http://localhost:8080/uaa/oauth/token",
            "scopes": {
                "default": "Default oauth2 scope."
            },
            "type": "oauth2"
        },
        "Client Credentials": {
            "flow": "application",
            "tokenUrl": "http://localhost:8080/uaa/oauth/token",
            "scopes": {
                "default": "Default oauth2 scope."
            },
            "type": "oauth2"
        },
        "Resource Owner Password Credentials": {
            "flow": "password",
            "tokenUrl": "http://localhost:8080/uaa/oauth/token",
            "scopes": {
                "default": "Default oauth2 scope."
            },
            "type": "oauth2"
        },
        "Implicit": {
            "flow": "implicit",
            "authorizationUrl": "http://localhost:8080/uaa/oauth/authorize",
            "scopes": {
                "default": "Default oauth2 scope."
            },
            "type": "oauth2"
        }
    },
    "security": [
        {
            "Authorization Code": []
        },
        {
            "Client Credentials": []
        },
        {
            "Resource Owner Password Credentials": []
        },
        {
            "Implicit": []
        }
    ]

Then the generated code looks like this:

      if (!string.IsNullOrEmpty(this.Configuration.AccessToken))
        options.HeaderParameters.Add("Authorization", "Bearer " + this.Configuration.AccessToken);
      if (!string.IsNullOrEmpty(this.Configuration.AccessToken))
        options.HeaderParameters.Add("Authorization", "Bearer " + this.Configuration.AccessToken);
      if (!string.IsNullOrEmpty(this.Configuration.AccessToken))
        options.HeaderParameters.Add("Authorization", "Bearer " + this.Configuration.AccessToken);
      if (!string.IsNullOrEmpty(this.Configuration.AccessToken))
        options.HeaderParameters.Add("Authorization", "Bearer " + this.Configuration.AccessToken);

Since the Authorization header is multivalued, the authentication fails with the service and it returns 401.

openapi-generator version

4.1.0

OpenAPI declaration file content or url

See description

Command line used for generation

openapi-generator generate -g csharp-netcore -i ./api.json --additional-properties targetFramework=netcoreapp2.0 -o ./netcoreapp2.0

Steps to reproduce

Run the command line above where api.json is a version 2.0 open api spec that includes the provided security definitions. Look at the generated code and see that it sets multiple values for the Authorization header. The expected behavior is for the Authorization header to be single valued.

Related issues/PRs
Suggest a fix

I think it should just set the Authorization header with a single value based on the configured access token.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the provided openapi-generator command with the version 2.0 api.json containing multiple security definitions, then inspect the generated csharp-netcore client authentication code. Done means the generated client adds only one Authorization header value instead of repeating it for each security definition, while still authenticating successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.