swagger-api / swagger-api/swagger-ui

logout button under authorize popup is not clearing cookies session

Open
#7,203 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
Content & configuration

Swagger Configuration Java Code:


    @Bean
	    public OpenAPI customOpenAPI() {
	    	final String securitySchemeName = "Basic Auth";

	    	return new OpenAPI()
	    			.addSecurityItem(new SecurityRequirement().addList(securitySchemeName))
	    			.components(
	    					new Components()
	    					.addSecuritySchemes(securitySchemeName,
	    							new SecurityScheme()
	    							.name(securitySchemeName)
	    							.type(SecurityScheme.Type.HTTP)
	    							.scheme("Basic")
	    							.in(SecurityScheme.In.HEADER)
	    							)
	    					)
	    			.info(new Info()
	    					.title(name)
	    					.description(description)
	    					.termsOfService("")
	    					.version(version)
	    					.license(new License()
	    							.name("Apache 2.0")
	    							.url("http://www.apache.org/licenses/LICENSE-2.0.html"))
	    					.contact(new io.swagger.v3.oas.models.info.Contact()
	    							.email("abc@xxxxx.com")));
	    }

Maven :

<dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-oas</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency> 


Describe the bug you're encountering

Logout button doesn't clear browser cookies session

To reproduce...

Steps to reproduce the behavior:

  1. Open Swagger Docs page.
  2. Click on "Authorize" button.
  3. Enter Username and password for basic auth.
  4. Click "Authorize"
  5. Getting proper expected output for given authentication credentials.
  6. To logout, it should clear browser session cookies.
  7. But it is not clearing browser cookies after click logout.
  8. Because of not clearing browser cookies, it is using old credentials for all REST API call.
Expected behavior

When I click logout, it should clear session in browser.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with Swagger UI's Authorize and logout flow, reproducing the behavior using the supplied Basic Auth configuration and the listed reproduction steps. Determine whether logout removes the browser's stored session credentials across the reported browsers; done means clicking logout no longer reuses the old credentials for subsequent API calls.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, javascript, spring-boot
Domain
authentication, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.