Swagger-ui: OAuth2 password flow sends token request incorrectly

[jniemin]

Seems that at least when using Resource owner password credentials flow for authentication, token request is sent incorrectly. Currently code on master sends is like this (/src/core/plugins/auth/actions.js)

let req = {
    url: schema.get("tokenUrl"),
    method: "post",
    headers: {
      "content-type": "application/x-www-form-urlencoded"
    },
    query: {
      grant_type: "password",
      username,
      password,
      scopes: encodeURIComponent(auth.scopes.join(scopeSeparator))
    }
  }

This means that all parameters are sent as query parameters not as part of body as spec defines (https://tools.ietf.org/html/rfc6749#section-4.3.2).

it could use instead body: new FormData(...) of query: {...}

[webron]

I think there should be a configuration for that, not sure if it's implemented yet.

[kevinsookocheff-wf]

I'm experiencing the same issue using the OAuth application flow. Requests are sent as GET requests and should be sent as POST to allow for encoding data in the POST body.

[lakmali]

I am also facing this problem. There is a configuration for sending client credentials; whether to send it as Basic header or in body. But there is no configuration available for sending payload data.
Nevertheless, according to the spec, payload should be sent as URL encoded POST payload. So I think, this needs to be fixed.

[bodnia]

@lakmali @kevinsookocheff-wf @jniemin could you please test latest master. If still experiencing the issue please re-open.

[jniemin]

Yep, the master is working correctly when using type: request body. My server doesn't support basic or as query params, so I can't test those. Thanks @bodnia

[bodnia]

@jniemin thanks for your cooperation