the key for clientAuthorizations.add must be the same as the one of the SecurityDefinition #134
Conversation
…he securitydefinition (in the startup class)
|
|
|
Well, the header is actually still abp.auth.tokenHeaderName (see the line before my edit). What I changed is the key for the add operation of clientAuthorizations, which must be identical to the key set in the securitydefinition for the swagger document. That key is now in startup.cs also a "magic string". To test this, I added a simple call to abp.swagger.login() at the end of on-complete.js. Then some dialogs appear which ask for tenant, username and password, and then you don't have to manually log in. I can only say that this automatic login procedure wasn't working for me until I made the change in this pull request. |
|
Which "line before my edit"?
|
| @@ -11,7 +11,7 @@ var abp = abp || {}; | |||
| return false; | |||
| } | |||
| var cookieAuth = new SwaggerClient.ApiKeyAuthorization(abp.auth.tokenHeaderName, 'Bearer ' + authToken, 'header'); | |||
There was a problem hiding this comment.
@acjh I'm talking about this line. Here the headername gets set.
| @@ -11,7 +11,7 @@ var abp = abp || {}; | |||
| return false; | |||
| } | |||
| var cookieAuth = new SwaggerClient.ApiKeyAuthorization(abp.auth.tokenHeaderName, 'Bearer ' + authToken, 'header'); | |||
| swaggerUi.api.clientAuthorizations.add(abp.auth.tokenHeaderName, cookieAuth); | |||
| swaggerUi.api.clientAuthorizations.add('bearerAuth', cookieAuth); | |||
There was a problem hiding this comment.
And here the header gets added to the clientAuthorizations of the swaggerui api. The key here is not necessarily the same as the headername. See swagger-api/swagger-ui#1244 (comment) for a more in depth explanation.
|
The |
|
The name of the header, yes indeed. But the name of what you add to swaggerUi.api.clientAuthorizations should match |
|
Did you try |
|
Yes, I did. But when I try a request after that with swagger ui, I still get 401 (Unauthorized) as the swagger ui doesn't send the "Authorization" header: |
|
I see. Thank you for the clarification. |
|
So, should I merge this :) |
|
Yes 👍 |
|
Explanation: The original PRs were tested separately and the helper works on its own, but adding the security definition requires that the client authorization added by the helper to have the same name. |
see securitydefinition defined in startup.cs
module-zero-core-template/aspnet-core/src/AbpCompanyName.AbpProjectName.Web.Host/Startup/Startup.cs
Line 72 in 8eb2944
see also swagger-api/swagger-ui#1244 (comment)