swagger-ui: Swagger-ui oauth2 accesscode flow not working correctly

@phenbach security must be an array.

"security": [
		{
			"qud_auth": [
				"qud_user",
				"bb_user"
			]
		}
	]

I ran into this problem last night and finally solved this issue but ran into another one. As far as fixing the above try using the oauth2-redirect.html in the dev-helpers folder. You will notice the oauth2.callback on line 39 has a couple of parameters that are needed.

oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});

Unfortunately for me when I attempt to try out the endpoint, my token is not included at all with the curl request. Can you report back if you experience the same issue?

It looks like CORS (cross-origin resource sharing) isn’t configured on the server you are accessing. There should be some “Access-Control-…” headers on the response. I think you should consider reading a bit about how CORS works.

This isn’t your POST request, it’s a preflight request, that checks if cross-origin requests are allowed to the endpoint. You can see that the request method is OPTIONS. The “Access-Control-Request-Method: POST” is a header, that shows, that the browser would like to do a POST and asks if it’s possioble.

This is why the “content” isn’t sent yet.

The problem is with the server you are trying to communicate with, some access policy is configured badly and it “catches” OPTIONS requests as well. Or it doesn’t have CORS enabled at all…

@bodnia Are you sure the “Access-Control-Allow-Origin” is being used correctly here? As I understand, this is a strictly a response header (a server puts this in the response for an OPTIONS request), but now it is included in POST requests. As this isn’t an expected header in requests, the OAuth server we are using rejects it.

“browser doesn’t allow to fetch anything to another domain. I need to put ‘access-control-allow-origin’ back to the code” CORS requests should be enabled in the server at the “another domain”, not in the client code…

@chanurahemal the fix is in the latest master

@chanurahemal browser doesn’t allow to fetch anything to another domain. I need to put ‘access-control-allow-origin’ back to the code.

Thank you @bodnia. I will test very soon and let you know for sure.

(Replacing the oauth2-redirect.html with the one in the dev-helpers fixes the first issue.)

I’m having similar issues with the accessCode flow, and am interested in some fix.

In my case: The oauth2-redirect page also does’t close, and in the chrome console I can see the following error:

If I return to the main swagger-ui page, I also see a “failed to fetch” error. As I see, the problem here is with CORS. In the console I get this error:

“Request header field access-control-allow-origin is not allowed by Access-Control-Allow-Headers in preflight response.”

And in the preflight request for the POST that would return the access token I see the following:

And it’s true, the “access-control-allow-origin” is not in the allowed headers, but I don’t understand why it would even be requested…

@chanurahemal If I find a solution I will post back, please do the same if you find one.