swagger-api / swagger-api/swagger-ui

oauth2-redirect and email links

Open
#6,150 0 comments 10 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth type: feature
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Is your feature request related to a problem?

The oauth2-redirect page (https://github.com/swagger-api/swagger-ui/blob/master/dev-helpers/oauth2-redirect.html) is looking for the originator of the oauth2 flow using window.opener. If we authorize the user through a link to this page provided in an email, the page will not find an opener and crash with

Uncaught TypeError: Cannot read property 'swaggerUIRedirectOauth2' of null
    at run (o2c.html:9)
    at onload (VM9 o2c.html:3)
Describe the solution you'd like

The callback page could fallback to rendering the swagger ui with the provided credentials if no opener can be found.

This does come at the expense of spawning new tabs and not being able to compare the sent payload with the one received from the server.

If there is a recommended way for generating callback links to include in emails I'd be interested to know more.

Describe alternatives you've considered

None. Allowing the swagger ui to accept a provided jwt might work as we can always get it from the callback link.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read dev-helpers/oauth2-redirect.html and trace how window.opener supplies swaggerUIRedirectOauth2. Reproduce the callback from an email link without an opener, then determine the supported fallback behavior and verify the callback no longer crashes while preserving the existing opener flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.