swagger-api / swagger-api/swagger-ui

Swagger-ui does not send the response_type parameter for openid connect authentication

Open
#7,894 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

Q&A (please complete the following information)
  • OS: macOS
  • Browser: chrome
  • Version: 22
  • Method of installation: npm
  • Swagger-UI version: 3.10.0
  • Swagger/OpenAPI version: OpenAPI 3.0
Content & configuration

The openId Connect dows not work with openapi3 and swagger.

Example Swagger/OpenAPI definition:

openapi: 3.0.1
info:
  description: "This is a sample."
  version: "1.0.0"
  title: "Swagger Petstore"
paths:
  /pet:
    get:
      tags:
      - "pet"
      summary: "Add a new pet to the store"
      description: ""
      operationId: "addPet"
      responses:
        "405":
          description: "Invalid input"
      security:
      - petstore_auth:
        - "email"
components:
  securitySchemes:
    petstore_auth:
      type: openIdConnect
      openIdConnectUrl: https://accounts.google.com/.well-known/openid-configuration
Describe the bug you're encountering

When I click authorize and select the last option in the authorization options, I get an error.

Authorization Error
Error 400: invalid_request
Required parameter is missing: response_type
To reproduce...

Steps to reproduce the behavior:

  1. Go to https://editor.swagger.io/
  2. Paste the above config
  3. Click authorize
  4. Select the last authorization option with all scopes
  5. See the error message
Expected behavior

Minimal openapi3 config with openid connect authentication should allow login.

Additional context or thoughts

Is there a way to set the response_type some how? Maybe this is only a documentation issue.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the OpenAPI 3 configuration in the Swagger Editor and tracing the Swagger UI authorize flow for the openIdConnect security scheme. Confirm where the authorization request is assembled; done means the request includes response_type and the documented minimal configuration allows login without the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.