swagger-api / swagger-api/swagger-ui
swagger-oauth2-redirect.html csp javascript blocked
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Q&A (please complete the following information)
- OS: windows/linux
- Browser: chorme/firefox/edge
- Version:
- Method of installation: dist
- Swagger-UI version: 4.15.5
- Swagger/OpenAPI version: Swagger 2.0, OpenAPI 3.0
Content & configuration
I have configured my application with following Content-Security-Policy header:
Content-Security-Policy "default-src 'self';font-src *;img-src * data:;script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';object-src 'none';frame-ancestors 'none';base-uri 'self'";
When using the oauth2 redirect functionality on the swagger UI, the page errors because the inline javascript of the swagger-oauth2-redirect.html is blocked by the csp header script-src
Solution
Move inline javascript from swagger-oauth2-redirect.html to a separate .js file
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with swagger-oauth2-redirect.html in the Swagger UI distribution and inspect the inline JavaScript that fails under the reported Content-Security-Policy. Move that behavior to a separate JavaScript asset while preserving the OAuth2 redirect flow, then verify the distributed page works without allowing inline scripts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100