swagger-api / swagger-api/swagger-ui

Client Secret with umlaut is not encoded

Open
#10,180 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

I defined a client secret with umlauts in my web service (using OpenIddict for OAuth2 authentication in the service).
When authenticating with SwaggerUI, the login is rejected:
swaggerui

Using Restfox, it works without problems. And Restfox gave me a hint: the request body is url encoded:

client_id=myservice&client_secret=%C3%B6rotkg%C3%B6odrtbjpo%C3%B6id%C3%B6woi4mfwp4wf3tgwp94w9&grant_type=client_credentials

So, I entered the client secret in SwaggerUI the same way, and it worked!

Thus I assume that SwaggerUI does not encode the client secret when sending the request, and I think it is a bug.

This is my original client secret (which fails):
örotkgöodrtbjpoöidöwoi4mfwp4wf3tgwp94w9
And this is url encoded (whichs works if entered like this in the "client_secret" field:
%C3%B6rotkg%C3%B6odrtbjpo%C3%B6id%C3%B6woi4mfwp4wf3tgwp94w9

I use Swashbuckle (https://github.com/domaindrivendev/Swashbuckle.AspNetCore) which currently bundles SwaggerUI 5.17.14

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the OAuth2 client-credentials flow in Swagger UI using the non-ASCII client secret described in the issue, then inspect the outgoing request body and compare it with the Restfox example. Done means Swagger UI sends the client_secret URL-encoded so authentication succeeds without manually encoding the value.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.