swagger-api / swagger-api/swagger-ui

Relative url for openid does not use server url

Open
#7,485 3 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cat: auth type: bug
Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: [windows]
  • Browser: [chrome]
  • Version: 93.0.4577.63 (Official Build) (32-bit)
  • Method of installation: https://editor.swagger.io/#
  • Swagger-Editor version: 3.52.0
  • Swagger/OpenAPI version: [OpenAPI 3.0.3]
Content & configuration

Example Swagger/OpenAPI definition:

openapi: 3.0.3
info:
  title: Test
  version: 1.0.0
servers:
  - url: https://api.example.com/v2
security:
  - openId: []
paths:
  /:
    get:
      tags:
        - Content
      responses:
        '200':
          description: All services of Content Storage Service
components:
  securitySchemes:
    openId:
      type: openIdConnect
      openIdConnectUrl: /.well-known/openid-configuration
Describe the bug you're encountering

Relative url is not resolved as documented in 'Relative Discovery URL' here: https://swagger.io/docs/specification/authentication/openid-connect-discovery/
(above sample is a working one from the documentation of above url)

To reproduce...

Steps to reproduce the behavior:

  1. Load above example in https://editor.swagger.io/#.
  2. Watch request (with fiddler or browser debugger) for well-known
  3. It will go to: https://editor.swagger.io/.well-known/openid-configuration
Expected behavior

Expected: https://api.example.com/.well-known/openid-configuration

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Load the provided OpenAPI 3.0.3 definition in Swagger Editor and inspect the request generated for the relative openIdConnectUrl. Trace how the server URL and discovery URL are resolved, then verify that the request targets https://api.example.com/.well-known/openid-configuration rather than the editor origin.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.