swagger-api / swagger-api/swagger-ui
Add "Client credentials location" combo box to "clientCredentials" OAuth flow authorization dialog instead of making the aforementioned control exclusive to password flow
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
- OS: Windows 11 Pro ja-JP
- Browser: Google Chrome 122
- Swagger version:
Swashbuckle.AspNetCore v6.5.0 - SwaggerUI version:
6.5.0as per NuGet - Installation method: NuGet + OpenAPI Generator
Duplicate of #9127 and #6125 to make sure the feature is implemented. Issue similar to #4533.
Content & configuration
Swagger/OpenAPI definition:
https://github.com/alexander-sil/Windows7ClassicUtils/blob/main/API_Retail_22.06.json
Swagger-UI configuration options:
app.UseSwagger(c =>
{
c.RouteTemplate = "openapi/{documentName}/openapi.json";
})
.UseSwaggerUI(c =>
{
// set route prefix to openapi, e.g. http://localhost:8080/openapi/index.html
c.RoutePrefix = "openapi";
//TODO: Either use the SwaggerGen generated OpenAPI contract (generated from C# classes)
c.SwaggerEndpoint("/openapi/1.0-oas3/openapi.json", "API для интеграции сервиса Яндекс.Еда");
//TODO: Or alternatively use the original OpenAPI contract that's included in the static files
// c.SwaggerEndpoint("/openapi-original.json", "API для интеграции сервиса Яндекс.Еда Original");
});
Is your feature request related to a problem?
Yes.
My use case requires implementing a Web API utilising OAuth authentication using client credentials grant flow with the credential data (client_id, client_secret, scope and grant_type) passed via request body.
Currently, the Swagger UI OAuth authorization dialog sends auth request to the TokenEndpoint with the client_id and client_secret contained in encoded form inside an Authorization header with Basic prefix, while scope and grant_type are transmitted via application/x-www-form-urlencoded JSON POST request body, as should be the case with the former.
It is infeasible to implement credential transmission via headers due to the fact that my client, access to which is unavailable for partners, does not strictly adhere to RFC standard described in #6125.
It is necessary for my endpoint to provide a JWT Bearer token by receiving OAuth credentials via application/x-www-form-urlencoded JSON POST request body, and there is no workarounds for the current version of the swagger-ui package.
Describe the solution you'd like
To put it explicitly, I would like to introduce an combo box to determine whether client credentials should be sent in a JSON request body, rather than sending the ID and secret in the headers or by other RFC-compliant means, into the authorization dialog for clientCredentials authentication flow, similar to a dropdown found in the password flow's authorization window.
This way I would make sure the Swagger UI authorization middleware successfully retrieves the token by sending credentials in the request JSON body content, along with scope and grant_type, in turn seamlessly authenticating the API's AuthorizeAttribute-locked endpoints.
Describe alternatives you've considered
I have not considered alternatives that severely impact the development workflow by integrating less seamless methods of authorization. This goes against principles of best practice in enterprise information technologies.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating Swagger UI's authorization dialog implementation for the clientCredentials and password OAuth flows, then compare how the existing client-credentials controls are rendered and submitted. Done means clientCredentials offers a client-credentials location choice and the selected option sends credentials in the requested form body; verify the existing OAuth authorization behavior and add coverage where the implementation's tests are located.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, authentication, frontend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100