Swagger-ui: How to specify Oauth2 headers that Swagger should use

[TurtleShip]

Hi, apologies in advance if this has been a known issue and I am re-reporting this. I spent a good part of today trying to find a solution to my current problem and was unable to. I searched swagger-ui issue reports as well but couldn't really find what I was looking for, so decide to ask here. Again, if this is not the correct forum, please kindly redirect me to the correct one.

I am using Swagger v2.0
I am developing an app that uses token based oauth, using devise_token_oauth gem. I specified my swagger security definition as below

"securityDefinitions": {
  "devise_auth": {
  "type": "oauth2",
    "authorizationUrl": "/api/doc/auth",
    "flow": "implicit",
    "tokenName": "access-token",
    "scopes": {
        "god": "God can do everything",
        "lecturer": "Lecturer can create courses"
    }
  }
}

And I also defined swagger path to use the security definition as below

"paths":{
    "/api/schools":
    {
        "post":{"description":"Creates a school. Only users with God permission can operate.",
                "tags":["school"],
                "security":[{"api_key":[]},
                    {"devise_auth":["god"]}],
                    "parameters":[...]
                }
    }
}

I defined api/doc/auth endpoint so that it returns all header information in query param. For example, it returns the below url

 http://localhost:3000/swagger-ui/dist/o2c.html?access-token=1FzOVl6NmBqEtycXnRIeUg&token-type=Bearer&client=EpUPSWWVbWPO2OkQG4Imng&expiry=1459736879&[email protected]

It has access-token, token-type, client, expiry, uid, all of which the Swagger needs to send to my API server to authenticate.

When I go to Swagger doc, I correctly see a toggle that asks me if I want to enable Oauth.

When I click it, the toggle correctly turn to "On".

However, when I send a request, I do not see auth header values ...

What am I doing wrong?
How can I tell Swagger doc that it needs to use auth params it got back from the AuthorizationUrl endpoint? Or is this type of question more appropriate for swagger-ui repo? I will keep this question until told otherwise.

Thanks in advance!

[migfabio]

I have the same issue 👍🏼

[TurtleShip]

Seems like this is not the correct forum to discuss this since no one is responding to this...

If anyone is reading this, can anyone please tell me how to make this more visible?

[webron]

You'd be surprised, we read everything. We just don't always have the capacity to answer everyone in a timely manner.

First question - do you see the problem only with the curl command or with the actual call from the Try it out operation (those are not the same)?

[TurtleShip]

ah-ha, okay.

I see the problem in both. I think the issue is that I am failing to register to Swagger what auth headers it should be using when Swagger sends authenticated requests.

Neither curl command or 'Try it out' operation sends any auth headers that I attempted to register with Swagger.

[webron]

@TurtleShip are you using the latest master version? Do you see the Authorize button at the top of the page?

[gabriel-detassigny]

Hi,
Not 100% sure if my issue is the same, but I'm having a very similar issue with Basic authentication. I'm using the latest master version.

The Authorize button shows the Basic authentication form correctly. However, the Authorization header is never sent through with the "Try it out" operation. It's not visible in the curl command either.

Please let me know if you need any further details.

[webron]

@gabriel-detassigny Can you share your spec?

[gabriel-detassigny]

That's the path :

"/account": {
            "get": {
                "tags": [
                    "account"
                ],
                "summary": "Get the current user account information",
                "responses": {
                    "200": {
                        "description": "User info"
                    }
                },
                "security": [
                    {
                        "login": []
                    }
                ]
            }
        },

That's the security definition :

"securityDefinitions": {
        "login": {
            "type": "basic"
        }
    }

Thanks for your help!

[webron]

@gabriel-detassigny - it would really help if you can share a simple spec that reproduces it so I can easily test it locally and try to reproduce it.

[gabriel-detassigny]

Here's the full json spec file (I had to change the domain name and some description / naming, because it's work related.)

{
    "swagger": "2.0",
    "info": {
        "title": "API",
        "description": "Internal API",
        "version": "1.0"
    },
    "host": "localhost",
    "basePath": "/",
    "schemes": [
        "http"
    ],
    "produces": [
        "application/json; versions=1"
    ],
    "paths": {
        "/account": {
            "get": {
                "tags": [
                    "account"
                ],
                "summary": "Get the current user account information",
                "responses": {
                    "200": {
                        "description": "User info"
                    }
                },
                "security": [
                    {
                        "login": []
                    }
                ]
            }
        }
    },
    "definitions": {},
    "securityDefinitions": {
        "login": {
            "type": "basic",
            "description": "Basic authentication"
        }
    }
}

By the way, I tried using API key authentication and that worked fine : it was sent through as a header like I needed. It seems to be only a problem with Basic authentication (and OAuth2 according to the others in this issue). Not sure if that info can help you.

Thanks again!

[webron]

@gabriel-detassigny thanks for sharing that - tested it and it indeed doesn't work. Can you open a separate ticket on this (with the attached spec)? I'm not sure it's the same issue as the original issue here and waiting for further details on that.

[aabadia]

I have the same problem. Any solution?

[bestdeveloperever]

+1

[AshwiniSurve]

I think you need to remove "api_key":[]" from you api security specification

[webron]

This should no longer be an issue with the new UI. However, if you test it and still experience a problem, please file a new ticket.

[Belhadjhala]

Hallo I am a Beginner with Swagger and i want to define a REST API with Token Header. I do now how to define that and how Swagger recognize the URL for the ressource , could you please help me to define that and thank you very much

[Aveline67]

I can also repdouce this issue. At least it could no an issue but then there is no any documentation for this purpose. Did someone achieve OAuth2 scenarion with swagger UI ? I get redircted with proper token and everying, yet I click on "try it" request do not send any token....