swagger-api / swagger-api/swagger-ui
redirect endpoint returning a 302 redirect to AWS S3 - generating an auth problem
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
I have a download endpoint in my API which is redirecting the user to a AWS S3 presigned URL
Here is the swagger file describing my endpoint:
openapi: 3.0.0
info:
title: My API
description: API
version: 2.0
servers:
- url: myapi.com
description: API v2.0.
components:
securitySchemes:
Auth:
type: apiKey
in: header
name: Authorization
security:
- Auth: []
paths:
/download/:
get:
summary: Download
description: Download
responses:
'302':
description: Redirects to a location for downloading
content:
application/gzip:
schema:
type: string
format: binary
My problem is when the SwaggerUI (version 3.14.2) it trying the endpoint it does get the redirect order,
but when it tries to go the redirect location it for some reason sends the "Authorization" header to that URL although it's not on the same domain.
This problem is causing AWS S3 to omit the following error because it's receiving both "Authorization" header and the "AWSAccessKeyId" get parameters.
<?xml version="1.0"?>
<Error>
<Code>InvalidArgument</Code>
<Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified</Message>
<ArgumentName>Authorization</ArgumentName>
<ArgumentValue>Token TTTTTTTTTTTTT</ArgumentValue>
<RequestId>RRRRRRRRRRRRRR</RequestId>
<HostId>HHHHHHHHHHHHHHHH</HostId>
</Error>
Any idea how to solve this issue?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Use the supplied OpenAPI definition and the /download/ endpoint to reproduce the 302 flow in Swagger UI 3.14.2. Inspect the redirect handling around the request that follows the AWS S3 presigned URL; done means the cross-domain request no longer forwards the API Authorization header and the presigned download succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100