swagger-api / swagger-api/swagger-ui

CORS Issue with oauth2 authentication (ClientCredentials)

Open
#5,104 15 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: support
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Hi,

I am new to SpringBoot, Springfox and Swagger2 as well. I am trying to generate Swagger2 API documentation with the help of Springfox.

I have gone through the documentation 'http://springfox.github.io/springfox/docs/current/' and able to generate API documentation.
But i am having issue to integrate with oauth2 authentication. I am trying to Implement oauth2 token to work on tryout option of each controller. With oauth/token (Client Credentials) implementation, able successfully connect my app login URL, but upon authentication the redirect URL is failing due to the following error.

The following exception is shown in browser"
Access to fetch at 'https://myauthserver/authserver/oauth/token' from origin 'http://myapp' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

The authentication server resides in a different domain. My app is running in different domain on same network.
Any Idea what causing the problem and how to add to allowed filter list in CORS to allow redirect URL successfully to Swagger UI.

Thank you

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Swagger UI OAuth2 tryout flow and the oauth/token request described in the report, then review the 15-comment thread for reproduction details. Confirm the behavior across the separate application and authentication-server domains, and consider the issue complete when Client Credentials authentication works from Swagger UI without the reported browser CORS failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi, spring-boot
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.