swagger-api / swagger-api/swagger-ui

Auth code not cleared after login, second authorization attempt fails

Open
#6,034 6 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Hacktoberfest type: bug
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: Windows 10
  • Browser: Chrome
  • Version: 81
  • Method of installation: nuget (Swashbuckle.Aspnetcore.Swagger)
  • Swagger-UI version: 3.25.0
  • Swagger/OpenAPI version: OpenAPI 3.0
Describe the bug you're encountering (includes steps to re-produce)
  1. Users clicks on 'Authorize' button
  2. OAuth pop-up shows and user clicks on Authorize.
  3. Login succeeds, pop-up now shows the 'Logout' button.
  4. User logs out
  5. Without closing the OAuth pop-up user tries to authorize again
  6. An error is returned, something like "error: invalid_grant, description: Authorization code is invalid or expired."
Expected behavior

User should be able to authorize/logout/authorize/etc in the same pop-up.

Screenshots

Unfortunately I cannot upload the screenshot at the moment. The error appears in the OAuth pop-up, in a red banner above the 'Authorize' and 'Close' buttons.

Additional context or thoughts

I've yet to verify my hypothesis but I suspect that Swagger UI is not clearing the auth code upon logout. So when the user tries to re-authorize, in the same pop-up, Swagger re-uses the auth code, which is only good strictly for one request (the first one).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Authorize button and OAuth pop-up flow described in the reproduction steps, then inspect what happens when the user logs out without closing the pop-up. Reproduce the authorize/logout/authorize sequence in Swagger UI 3.25.0 with OpenAPI 3.0. Done means repeated authorization succeeds in the same pop-up after logout.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.