swagger-api / swagger-api/swagger-ui

Auth Error: not found authorizationcode flow

Open
#6,425 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth type: question
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

I'm confugring swagger ui to use authorizationCode flow with LinkedIn. Once I click on "Authorize" button I'm able to go to LinkedIn sign in page, authenticate successfully. However, as I'm redirected back to swagger ui, I'm getting "Auth Error: Error".

In the console I'm seeing:

swagger-ui-bundle.js:71 POST https://localhost:5001/swagger/index.html

Here's my configuration.

   public class Startup
    {
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();

        services.AddAuthentication("Bearer")
            .AddIdentityServerAuthentication("Bearer", options =>
            {
                options.ApiName = "api1";
                options.Authority = "https://localhost:5000";
            });

        services.AddSwaggerGen(options =>
        {
            options.SwaggerDoc("v1", new OpenApiInfo { Title = "Protected API", Version = "v1" });

            options.AddSecurityDefinition("oauth2", new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.OAuth2,
                Flows = new OpenApiOAuthFlows
                {
                    AuthorizationCode = new OpenApiOAuthFlow
                    {
                        AuthorizationUrl = new Uri("https://www.linkedin.com/oauth/v2/authorization"),
                        Scopes = new Dictionary<string, string>
                        {
                             { "r_liteprofile", ""  },
                             { "r_emailaddress", "" }
                        }
                    }
                }
            });

            options.OperationFilter<AuthorizeCheckOperationFilter>();
            
        });
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        //app.UseHttpsRedirection();
        app.UseSwagger();
        app.UseSwaggerUI(options =>
        {
            options.SwaggerEndpoint("/swagger/v1/swagger.json", "My API V1");

            options.OAuthClientId("myClientId");
            options.OAuthAppName("Demo API - Swagger");
            options.OAuthUsePkce();
        });

        app.UseRouting();

        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}
public class AuthorizeCheckOperationFilter : IOperationFilter
{
    public void Apply(OpenApiOperation operation, OperationFilterContext context)
    {
        var hasAuthorize = context.MethodInfo.DeclaringType.GetCustomAttributes(true).OfType<AuthorizeAttribute>().Any() ||
                           context.MethodInfo.GetCustomAttributes(true).OfType<AuthorizeAttribute>().Any();

        if (hasAuthorize)
        {
            operation.Responses.Add("401", new OpenApiResponse { Description = "Unauthorized" });
            operation.Responses.Add("403", new OpenApiResponse { Description = "Forbidden" });

            operation.Security = new List<OpenApiSecurityRequirement>
            {
                new OpenApiSecurityRequirement
                {
                    [new OpenApiSecurityScheme {Reference = new OpenApiReference {Type = ReferenceType.SecurityScheme, Id = "oauth2"}}]
                        = new[] {"api1"}
                }
            };
        }
    }
}`

Any suggestion on how I can resolve this issue?

I'm using v 5.6.1 of Swashbuckle.AspNetCore.Swagger.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Swagger UI OAuth configuration in Startup.Configure, then inspect the POST shown at swagger-ui-bundle.js:71 and the redirect response from LinkedIn. Compare the configured authorizationCode flow, client settings, and scopes with the observed network request. Done means the Authorize flow completes without the Auth Error and a protected API request succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, javascript
Domain
api, authentication, documentation
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.