swagger-api / swagger-api/swagger-ui
logout button under authorize popup is not clearing cookies session
Open
Nobody has claimed this yet.
cat: auth
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Q&A (please complete the following information)
- OS: Windows
- Browser: All browsers
- Version: all versions
- Method of installation: through Java Spring boot Maven
- Swagger-UI version: https://mvnrepository.com/artifact/io.springfox/springfox-swagger-ui/3.0.0
- Swagger/OpenAPI version: Swagger 2.0, OpenAPI 3.0
Content & configuration
Swagger Configuration Java Code:
@Bean
public OpenAPI customOpenAPI() {
final String securitySchemeName = "Basic Auth";
return new OpenAPI()
.addSecurityItem(new SecurityRequirement().addList(securitySchemeName))
.components(
new Components()
.addSecuritySchemes(securitySchemeName,
new SecurityScheme()
.name(securitySchemeName)
.type(SecurityScheme.Type.HTTP)
.scheme("Basic")
.in(SecurityScheme.In.HEADER)
)
)
.info(new Info()
.title(name)
.description(description)
.termsOfService("")
.version(version)
.license(new License()
.name("Apache 2.0")
.url("http://www.apache.org/licenses/LICENSE-2.0.html"))
.contact(new io.swagger.v3.oas.models.info.Contact()
.email("abc@xxxxx.com")));
}
Maven :
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-oas</artifactId>
<version>3.0.0</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger-ui</artifactId>
<version>3.0.0</version>
</dependency>
Describe the bug you're encountering
Logout button doesn't clear browser cookies session
To reproduce...
Steps to reproduce the behavior:
- Open Swagger Docs page.
- Click on "Authorize" button.
- Enter Username and password for basic auth.
- Click "Authorize"
- Getting proper expected output for given authentication credentials.
- To logout, it should clear browser session cookies.
- But it is not clearing browser cookies after click logout.
- Because of not clearing browser cookies, it is using old credentials for all REST API call.
Expected behavior
When I click logout, it should clear session in browser.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Swagger UI's Authorize and logout flow, reproducing the behavior using the supplied Basic Auth configuration and the listed reproduction steps. Determine whether logout removes the browser's stored session credentials across the reported browsers; done means clicking logout no longer reuses the old credentials for subsequent API calls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, javascript, spring-boot
- Domain
- authentication, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100