JWT Bearer authentication no longer works since update to openapi v2
See original GitHub issueIssue
Previously in v9.4.2
the apikey textbox entry could be used to paste in a jwt and the following securityDefinitions
object would work without issue:
securityDefinitions:
{
jwt:
{
type: 'apiKey',
name: 'Authorization',
in: 'header'
}
}
Since updating to 10.0.2
and after entering a jwt into the dialog from the authorize button in the swagger ui, this no longer works and the only header that is sent is the accept
header.
Environment
Node: 10.15.3 - C:\Program Files (x86)\nodejs\node.EXE
Yarn: 1.16.0 - C:\Program Files (x86)\Yarn\bin\yarn.CMD
npm: 6.7.0 - C:\Program Files (x86)\nodejs\npm.CMD
"@hapi/good": "^8.2.0",
"@hapi/good-console": "^8.1.0",
"@hapi/good-squeeze": "^5.2.0",
"@hapi/hapi": "^18.3.1",
"@hapi/inert": "^5.2.1",
"@hapi/vision": "^5.5.2",
"hapi-auth-jwt2": "^8.6.1",
"hapi-swagger": "^10.0.2",
Steps to Reproduce
- Setup
hapi-swagger
with thesecurityDefinition
shown above - Enter a value into the dialog launched from the authorize button
- Trigger an endpoint that requires authorisation and determine if the
authorization
header is sent
Issue Analytics
- State:
- Created 4 years ago
- Comments:11
Top Results From Across the Web
JWT Bearer authentication no longer works since update to ...
Since updating to 10.0.2 and after entering a jwt into the dialog from the authorize button in the swagger ui, this no longer...
Read more >Web API Core JWT Authentication is not working
It is working fine when using from postman but from swagger it gives me auth token when i use that token to access...
Read more >Troubleshooting JWT validation | Cloud Endpoints with OpenAPI
This may happen when deploying ESPv2 in Cloud Run, the flag --allow-unauthenticated is not used in gcloud run deploy command. If the flag...
Read more >Bearer Authentication - Swagger
In OpenAPI 3.0, Bearer authentication is a security scheme with type: http and scheme: bearer . You first need to define the security...
Read more >Controlling access to HTTP APIs with JWT authorizers
You can use JSON Web Tokens (JWTs) as a part of OpenID Connect (OIDC) and OAuth 2.0 frameworks to restrict client access to...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
For those that are interested, I was trying to sort through this issue and during my testing I found that a small config tweak caused my Swagger UI to start sending Authorization headers to my backend again:
And this is with the current latest release, no modifications from the jwt fix branch needed.
@emanuelet work was started in https://github.com/glennjones/hapi-swagger/tree/fix/jwt-authentication for potential fix but my bandwidth is limited at moment. Contributions would be appreciated.