swagger-api / swagger-api/swagger-ui

Add "Client credentials location" combo box to "clientCredentials" OAuth flow authorization dialog instead of making the aforementioned control exclusive to password flow

Open
#9,711 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

  • OS: Windows 11 Pro ja-JP
  • Browser: Google Chrome 122
  • Swagger version: Swashbuckle.AspNetCore v6.5.0
  • SwaggerUI version: 6.5.0 as per NuGet
  • Installation method: NuGet + OpenAPI Generator

Duplicate of #9127 and #6125 to make sure the feature is implemented. Issue similar to #4533.

Content & configuration

Swagger/OpenAPI definition:

https://github.com/alexander-sil/Windows7ClassicUtils/blob/main/API_Retail_22.06.json

Swagger-UI configuration options:

app.UseSwagger(c =>
   {
       c.RouteTemplate = "openapi/{documentName}/openapi.json";
   })
   .UseSwaggerUI(c =>
   {
   // set route prefix to openapi, e.g. http://localhost:8080/openapi/index.html
   c.RoutePrefix = "openapi";
   //TODO: Either use the SwaggerGen generated OpenAPI contract (generated from C# classes)
   c.SwaggerEndpoint("/openapi/1.0-oas3/openapi.json", "API для интеграции сервиса Яндекс.Еда");

   //TODO: Or alternatively use the original OpenAPI contract that's included in the static files
   // c.SwaggerEndpoint("/openapi-original.json", "API для интеграции сервиса Яндекс.Еда Original");
   });

Is your feature request related to a problem?

Yes.
My use case requires implementing a Web API utilising OAuth authentication using client credentials grant flow with the credential data (client_id, client_secret, scope and grant_type) passed via request body.
Currently, the Swagger UI OAuth authorization dialog sends auth request to the TokenEndpoint with the client_id and client_secret contained in encoded form inside an Authorization header with Basic prefix, while scope and grant_type are transmitted via application/x-www-form-urlencoded JSON POST request body, as should be the case with the former.
It is infeasible to implement credential transmission via headers due to the fact that my client, access to which is unavailable for partners, does not strictly adhere to RFC standard described in #6125.
It is necessary for my endpoint to provide a JWT Bearer token by receiving OAuth credentials via application/x-www-form-urlencoded JSON POST request body, and there is no workarounds for the current version of the swagger-ui package.

Describe the solution you'd like

To put it explicitly, I would like to introduce an combo box to determine whether client credentials should be sent in a JSON request body, rather than sending the ID and secret in the headers or by other RFC-compliant means, into the authorization dialog for clientCredentials authentication flow, similar to a dropdown found in the password flow's authorization window.
This way I would make sure the Swagger UI authorization middleware successfully retrieves the token by sending credentials in the request JSON body content, along with scope and grant_type, in turn seamlessly authenticating the API's AuthorizeAttribute-locked endpoints.

Describe alternatives you've considered

I have not considered alternatives that severely impact the development workflow by integrating less seamless methods of authorization. This goes against principles of best practice in enterprise information technologies.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating Swagger UI's authorization dialog implementation for the clientCredentials and password OAuth flows, then compare how the existing client-credentials controls are rendered and submitted. Done means clientCredentials offers a client-credentials location choice and the selected option sends credentials in the requested form body; verify the existing OAuth authorization behavior and add coverage where the implementation's tests are located.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, authentication, frontend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.