swagger-ui: Auth Error, Error: Bad Request
Q&A (please complete the following information)
- OS: macOs
- Browser: chrome
- Version: 69
- Method of installation: npm
- Swagger-UI version: ? swagger-ui-express 3.0.1 comes with a static directory with swagger ui.
- Swagger/OpenAPI version: 2
Content & configuration
Example Swagger/OpenAPI definition:
securityDefinitions:
oauth:
type: oauth2
tokenUrl: /oauth/token
flow: application
security:
- oauth: []
Swagger-UI configuration options:
// Configure Swagger Docs
let swaggerDocument = yaml.safeLoad(fs.readFileSync('./api/swagger/swagger.yaml', 'utf8'));
app.use('/docs', swaggerUi.serve, swaggerUi.setup(swaggerDocument));
Describe the bug you’re encountering
I am no longer able to authentication through live docs. Debugging the POST request to /oauth/token via chrome devtools shows that the client_id and client_secret are not being send. grant_type is and is the correct value “client_credentials”.
To reproduce…
Steps to reproduce the behavior:
- Go to /docs (my configured router for swagger ui via express)
- Click on ‘Authenticate’
- Enter ‘client_id’
- Enter ‘client_secret’
- Click modal ‘Authenticate’ button, which submits the form
- See error
Expected behavior
Should authenticate
Screenshots

Additional context or thoughts
I know that the yaml config for OAuth2 is being consumed because its giving me the OAuth2 authentication form. The break down is in sending the entered credentials.
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 15 (6 by maintainers)
@pacey, can you email me about this? I have a branch here, I’d like for you to take a look and tell me if it addresses your use case.
kyle.shockey@smartbear.com.Thanks for the clarification here. For future readers the basic authorization header is constructed by base 64 encoded a string that contains client_id and client_secret and is delimited by “:”.
@bozzltron, upon further investigation, my impression is that we’re doing this correctly.
OAuth2 says (emphasis mine):
Since Swagger UI is able to use HTTP basic to transmit the client credentials, we do that instead of including it in the request body.
Let me know if you think I’ve misinterpreted the spec - happy to take another look.