swagger-api / swagger-api/swagger-ui
Swagger-ui does not send the response_type parameter for openid connect authentication
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Q&A (please complete the following information)
- OS: macOS
- Browser: chrome
- Version: 22
- Method of installation: npm
- Swagger-UI version: 3.10.0
- Swagger/OpenAPI version: OpenAPI 3.0
Content & configuration
The openId Connect dows not work with openapi3 and swagger.
Example Swagger/OpenAPI definition:
openapi: 3.0.1
info:
description: "This is a sample."
version: "1.0.0"
title: "Swagger Petstore"
paths:
/pet:
get:
tags:
- "pet"
summary: "Add a new pet to the store"
description: ""
operationId: "addPet"
responses:
"405":
description: "Invalid input"
security:
- petstore_auth:
- "email"
components:
securitySchemes:
petstore_auth:
type: openIdConnect
openIdConnectUrl: https://accounts.google.com/.well-known/openid-configuration
Describe the bug you're encountering
When I click authorize and select the last option in the authorization options, I get an error.
Authorization Error
Error 400: invalid_request
Required parameter is missing: response_type
To reproduce...
Steps to reproduce the behavior:
- Go to https://editor.swagger.io/
- Paste the above config
- Click authorize
- Select the last authorization option with all scopes
- See the error message
Expected behavior
Minimal openapi3 config with openid connect authentication should allow login.
Additional context or thoughts
Is there a way to set the response_type some how? Maybe this is only a documentation issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the OpenAPI 3 configuration in the Swagger Editor and tracing the Swagger UI authorize flow for the openIdConnect security scheme. Confirm where the authorization request is assembled; done means the request includes response_type and the documented minimal configuration allows login without the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100