swagger-api / swagger-api/swagger-ui
UI version 5.20 breaks relative Oauth2 URls
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Q&A (please complete the following information)
- OS: [e.g. macOS]: Windows
- Browser: [e.g. chrome, safari]: Chrome
- Version: [e.g. 22] 133
- Method of installation: [e.g. npm, dist assets] dist assets
- Swagger-UI version: [e.g. 3.10.0] 5.20
- Swagger/OpenAPI version: [e.g. Swagger 2.0, OpenAPI 3.0] OpenAPI 3.0
Content & configuration
Swagger-UI configuration options:
"securitySchemes": {
"OIDC": {
"type": "oauth2",
"description": "Bearer Authentication",
"flows": {
"authorizationCode": {
"authorizationUrl": "./../identity/connect/authorize",
"tokenUrl": "./../identity/connect/token",
"scopes": {
"api": "API Scope"
}
}
}
}
}
Describe the bug you're encountering
Assuming the swagger endpoint is /swagger and
assuming you have relative OAuth2 configuration URLs, with relative URIs, V5.20 redirects to
"/swagger/identity/connect/authorize" on clicking the Authorize button. It ignores the relative "../" part from the url.
Example:
https://localhost/swagger with swagger json on https://localhost/swagger/v1/swagger.json, then the above configuration redirects to: https://localhost/swagger/identity/connect/authorize, instead of https://localhost/identity/connect/authorize.
To reproduce...
Steps to reproduce the behavior:
Configure relative OAuth2 security scheme as above, with any given swagger config and click Authorize
Expected behavior
It redirects to "/identity/connect/authorize"
Additional context or thoughts
This works in 5.19.
this was found in Swashbuckle for .NET and repro'd to be the UI change
https://github.com/domaindrivendev/Swashbuckle.AspNetCore/issues/3287
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Reproduce the OAuth2 authorization flow in Swagger UI 5.20 with the shown relative URLs, then compare it with 5.19; the fix is complete when ../identity/connect/authorize resolves to /identity/connect/authorize instead of /swagger/identity/connect/authorize.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100