swagger-api / swagger-api/swagger-ui

Automatic token refresh for REST API with OpenID Connect authentication?

Open
#7,257 23 comments 49 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth pull-request-welcome type: enhancement
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: Linux Mint 20.1
  • Browser: Chromium
  • Version: 90.0.4430.93
  • Method of installation: by Springdoc 1.5.8
  • Swagger-UI version: 3.47.1
  • Swagger/OpenAPI versionOpenAPI 3.0
Content & configuration

I am developing an application having a REST API that is secured by Spring Security, using Keycloak to provide OpenID Connect functionalities.
The OpenAPI specification is generated using Springdoc. AFAIK, the correct way of getting SwaggerUI to authenticate against OpenID Connect is to use OpenID Connect Discovery.

Swagger/OpenAPI definition:

openapi: 3.0.1
info:
  title: NEW API
  description: This document specifies the API of NEW
  version: v0.1-SNAPSHOT
servers:
  - url: 'http://localhost:8080'
    description: Generated server url
security:
  - oidc: []
paths:
  /p/list:
    get:
      tags:
        - plugin-controller
      operationId: getAllOperations
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                type: array
                items:
                  type: string
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/JSONResponse'
        '401':
          description: Unauthorized
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/JSONResponse'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/JSONResponse'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/JSONResponse'

components:
  schemas:
    JSONResponse:
      type: object
      properties:
        errorData:
          type: string
          description: the raw error data
        token:
          type: string
  securitySchemes:
    oidc:
      type: openIdConnect
      openIdConnectUrl: 'http://localhost:8888/auth/realms/new/.well-known/openid-configuration'

How can we help?

Authorization works well in principal, but the application needs to do a token refresh automatically and regularly.
Currently, I can send valid request to the API until the validity of the token acquired during login has expired.
In the SwaggerUI documentation, I did not find how to configure such a thing like token refresh.
Is SwaggerUI able to perform an automatic token refresh or is there eventually a possibility that the user can trigger it manually?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names no repository files, tests, or entry points. Start by tracing Swagger UI's OpenID Connect authentication and token lifecycle, then check existing authentication tests; done means expired tokens can be refreshed automatically and the user has a supported manual refresh option.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, spring
Domain
api, authentication, frontend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.