swagger-api / swagger-api/swagger-ui
Auth code not cleared after login, second authorization attempt fails
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Q&A (please complete the following information)
- OS: Windows 10
- Browser: Chrome
- Version: 81
- Method of installation: nuget (Swashbuckle.Aspnetcore.Swagger)
- Swagger-UI version: 3.25.0
- Swagger/OpenAPI version: OpenAPI 3.0
Describe the bug you're encountering (includes steps to re-produce)
- Users clicks on 'Authorize' button
- OAuth pop-up shows and user clicks on Authorize.
- Login succeeds, pop-up now shows the 'Logout' button.
- User logs out
- Without closing the OAuth pop-up user tries to authorize again
- An error is returned, something like "error: invalid_grant, description: Authorization code is invalid or expired."
Expected behavior
User should be able to authorize/logout/authorize/etc in the same pop-up.
Screenshots
Unfortunately I cannot upload the screenshot at the moment. The error appears in the OAuth pop-up, in a red banner above the 'Authorize' and 'Close' buttons.
Additional context or thoughts
I've yet to verify my hypothesis but I suspect that Swagger UI is not clearing the auth code upon logout. So when the user tries to re-authorize, in the same pop-up, Swagger re-uses the auth code, which is only good strictly for one request (the first one).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Authorize button and OAuth pop-up flow described in the reproduction steps, then inspect what happens when the user logs out without closing the pop-up. Reproduce the authorize/logout/authorize sequence in Swagger UI 3.25.0 with OpenAPI 3.0. Done means repeated authorization succeeds in the same pop-up after logout.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100