swagger-api / swagger-api/swagger-ui

UI version 5.20 breaks relative Oauth2 URls

Open
#10,340 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

cat: security P1 type: bug
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: [e.g. macOS]: Windows
  • Browser: [e.g. chrome, safari]: Chrome
  • Version: [e.g. 22] 133
  • Method of installation: [e.g. npm, dist assets] dist assets
  • Swagger-UI version: [e.g. 3.10.0] 5.20
  • Swagger/OpenAPI version: [e.g. Swagger 2.0, OpenAPI 3.0] OpenAPI 3.0
Content & configuration

Swagger-UI configuration options:

 "securitySchemes": {
      "OIDC": {
        "type": "oauth2",
        "description": "Bearer Authentication",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "./../identity/connect/authorize",
            "tokenUrl": "./../identity/connect/token",
            "scopes": {
              "api": "API Scope"
            }
          }
        }
      }
    }
Describe the bug you're encountering

Assuming the swagger endpoint is /swagger and
assuming you have relative OAuth2 configuration URLs, with relative URIs, V5.20 redirects to
"/swagger/identity/connect/authorize" on clicking the Authorize button. It ignores the relative "../" part from the url.

Example:
https://localhost/swagger with swagger json on https://localhost/swagger/v1/swagger.json, then the above configuration redirects to: https://localhost/swagger/identity/connect/authorize, instead of https://localhost/identity/connect/authorize.

To reproduce...

Steps to reproduce the behavior:
Configure relative OAuth2 security scheme as above, with any given swagger config and click Authorize

Expected behavior

It redirects to "/identity/connect/authorize"

Additional context or thoughts

This works in 5.19.

this was found in Swashbuckle for .NET and repro'd to be the UI change
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/issues/3287

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Reproduce the OAuth2 authorization flow in Swagger UI 5.20 with the shown relative URLs, then compare it with 5.19; the fix is complete when ../identity/connect/authorize resolves to /identity/connect/authorize instead of /swagger/identity/connect/authorize.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.