Default scopes sent for security schemes which do not support them

Q&A (please complete the following information)

• OS: win
• Browser: chrome
• Version: 94
• Method of installation: Integrated via NSwag
• Swagger-UI version: 3.48.0
• Swagger/OpenAPI version: OpenAPI 3.0

Content & configuration

initOAuth called with a list of scopes (introduced in https://github.com/swagger-api/swagger-ui/pull/6037)

Example Swagger/OpenAPI definition:

{
	"password": {
		"type": "oauth2",
		"description": "Username / Password Logon",
		"flows": {
			"password": {
				"tokenUrl": "Token"
			}
		}
	},
	"oauth": {
		"type": "oauth2",
		"description": "oAuth Logon",
		"flows": {
			"implicit": {
				"authorizationUrl": "https://login.domain.com/connect/authorize",
				"tokenUrl": "https://login.domain.com/connect/token",
				"scopes": {
					"openid": "openid",
					"profile": "profile",
					"email": "email",
					"role": "role"
				}
			}
		}
	}
}

Describe the bug you're encountering

We have a mixed setup of different ways to authorize with our API. Local auth using username + password against a Token Endpoint on the API itself and an oAuth based login handled via an external openid server.

As can be seen, the oauth flow requires a few scopes, while the local implementation does not.

Now, when initOAuth is initialized with a list of scopes (in order to pre-select those scopes in the Authorize-Dialog), these scopes are set into the state.

See this line:
https://github.com/swagger-api/swagger-ui/blob/f1ad60dc92e7edb0898583e16c3e66fe3e9eada2/src/core/components/auth/oauth2.jsx#L38

This leads to problems, when the security scheme without scopes is used, because the scopes are actually sent along with the request which does not define any scopes at all. The UI does also not allow to select scopes.

To reproduce...

See description, everything's there

Expected behavior

No scopes are sent for security definitions, which do not support scopes. Or better said, only those are sent, which are actually supported.

Start in src/core/components/auth/oauth2.jsx at the initOAuth scope handling around the linked line, then trace how those scopes reach authorization requests for the defined security schemes. Done means scopes are sent only for schemes or flows that support them, while schemes without scopes send no scopes.