window.opener is null after Cognito (cross-origin OAuth) login

Q&A

• OS: Windows 11
• Browser: MS Edge
• Version: Version 146.0.3856.97
• Method of installation: Swashbuckle.AspNetCore 9.0.6 (NuGet)
• Swagger-UI version: 5.29.2 (bundled by Swashbuckle)
• Swagger/OpenAPI version: OpenAPI 3.0

Content & configuration

OAuth2 security definition (authorization code + PKCE) with a cross-origin provider (AWS Cognito Hosted UI):

components:
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://<cognito-domain>.auth.<region>.amazoncognito.com/oauth2/authorize
          tokenUrl: https://<cognito-domain>.auth.<region>.amazoncognito.com/oauth2/token
          scopes:
            openid: OpenID Connect
            email: Email address
            profile: User profile

Swagger-UI configuration options (via Swashbuckle):

options.OAuthClientId("<client-id>");
options.OAuthUsePkce();
options.OAuthScopes("openid", "email", "profile");

Describe the bug you're encountering

oauth2-redirect.js unconditionally accesses window.opener.swaggerUIRedirectOauth2 with no null check. When the OAuth2 popup navigates through a cross-origin identity provider, the browser severs window.opener, and the redirect page crashes:

Uncaught TypeError: Cannot read properties of null (reading 'swaggerUIRedirectOauth2')
    at run (oauth2-redirect.js:1:55)

The auth code is never relayed back to the Swagger UI tab.

To reproduce...

1. Configure OAuth2 authorization code + PKCE flow with a cross-origin provider (AWS Cognito Hosted UI, though this should affect any provider on a different origin)
2. Click Authorize in Swagger UI
3. Complete login at the identity provider
4. Provider redirects back to oauth2-redirect.html
5. Blank page. Console shows the TypeError above.

Expected behavior

The auth code should be relayed back to the Swagger UI tab and the token exchange should complete.

Screenshots

Additional context or thoughts

Clicking Authorize a second time works - the provider already has a session, so the redirect is instant and window.opener is preserved. The issue only occurs when the popup fully navigates to the cross-origin login page, which gives the browser reason to sever the opener reference.

Notably, the Cognito redirect response does not include a Cross-Origin-Opener-Policy header. The browser is severing window.opener due to the cross-origin navigation alone, not an explicit COOP policy.

This will likely affect any cross-origin OAuth provider, not just Cognito. My current workaround is serving a custom oauth2-redirect.html that uses an alternative cross-tab communication mechanism (e.g., localStorage + storage event).

Related issues

• #8030
• #5403
• #8315
• #6150

Start with oauth2-redirect.js and the oauth2-redirect.html flow, reproducing the first-login path with a cross-origin OAuth provider such as Cognito. Trace how the popup returns the authorization code to the Swagger UI tab when window.opener is unavailable. Done means the code is relayed and the PKCE token exchange completes without the TypeError.