jetbridge / jetbridge/sls-flask

swagger UI send request to endpoint without stage and return 403

Open
#10 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
93
Forks
6
PR merge metrics
No merged PRs in 30d

Description

I managed to create and deploy an application to AWS via this sls-flask service, but the swagger generated doesn't work, after enable the developer tools on Chrome, I found click the execute on swagger, it sends the request to an endpoint with stage, for example:

After "sls deploy -s dev", the output will contain the endpoint which looks like:
https://xxxxxx.execute-api.ap-southeast-2.amazonaws.com/dev

And the swagger page can be accessed via:
https://xxxxxx.execute-api.ap-southeast-2.amazonaws.com/dev/api/swagger

But when click the "execute" for api "/api/auth/login", the request will be sent to:
https://xxxxxx.execute-api.ap-southeast-2.amazonaws.com/api/auth/login
and it return "403" {"message":"Forbidden"}

If the request is sent to https://xxxxxx.execute-api.ap-southeast-2.amazonaws.com/dev/api/auth/login, it works.

If I change the Blueprint "url_prefix="/api/auth" to "url_prefix="/dev/api/auth", it still doesn't work since now the correct endpoint should be https://xxxxxx.execute-api.ap-southeast-2.amazonaws.com/dev/dev/api/auth/login.

It looks like when sls-flask generate the swagger, it ignores the stage.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue by deploying with `sls deploy -s dev`, opening the `/api/swagger` page, and executing `/api/auth/login`. Inspect how the generated Swagger request URL is formed relative to the deployed stage. Done means the request includes the stage once and reaches the endpoint without a 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, openapi, python
Domain
api, backend, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.