Support for Authorization code flow with PKCE ?

[svenerp]

I am trying to get authorization code flow with PKCE to work.
When clicking authorize I get the following error:
[invalid_request]: code challenge required.

Am I doing something wrong, or is the flow not supported (yet)?
Client Credential flow and implicit flow both work fine.

[jamesthurley]

It looks like this is now supported in Swagger UI as of 8 October:

swagger-api/swagger-ui#5361 (comment)

[espenrl]

I wanted to do a pull request on this. But I'm unsure about upgrading the bundled swagger-ui files. I've done an analysis of what needs to be done.

1. Upgrade bundled swagger-ui (Swagger UI 3 only)
2. Add configuration property UsePkceWithAuthorizationCodeGrant
3. Template the property into index.html

2

NSwag/src/NSwag.AspNetCore/OAuth2ClientSettings.cs

Line 18 in 1a6c959

public class OAuth2ClientSettings

/// <summary>Proof Key for Code Exchange. Only applies to `accessCode` flow. Supported in SwaggerUI 3.</summary>
public bool UsePkceWithAuthorizationCodeGrant { get; set; }

3

NSwag/src/NSwag.AspNetCore/SwaggerUi3/index.html

Line 87 in 1a6c959

ui.initOAuth({

usePkceWithAuthorizationCodeGrant: {UsePkceWithAuthorizationCodeGrant}

NOTE: SwaggerUi3Settings.TransformHtml code will do the actual job of inserting the property into index.html.

[RicoSuter]

Can you create a PR? I’ll update swagger ui 3

[espenrl]

Sure, I have actually figured out how to update the swagger-ui library. I will do some testing and make a PR.

[colinheppener]

Good day,
First of all I'd like to thank you all for working on such a great project.
I was wondering if there is any idea when this might be included in a future release?
I was hoping to use it for a project I'm working on right now and this feature was merged after the most recent NuGet package release. Thanks!

[RicoSuter]

I’ll publish a new version next week

[colinheppener]

That would be perfect. Thanks!

[sreedharbestha]

I took latest version of NSwag.AspNet.Owin v13.1.5 to work with PKCE code flow using SwaggerUi3 extension. However I ended up with code_challenge is missing error.

Looking at the latest version of NSwag.AspNet.Owin v13.1.5 is still not supported with PKCE however its only available in NSwag.AspNetCore as of now.

Please let me know when it will be available in NSwag.AspNet.Owin package.

[espenrl]

I upgraded the NuGet package and it works like a charm. A couple of properties need to be set.

OAuth2ClientSettings.UsePkceWithAuthorizationCodeGrant = true and

services.AddOpenApiDocument(options =>
 {
    options.DocumentProcessors.Add(new SecurityDefinitionAppender("Bearer", Enumerable.Empty<string>(),
                    new OpenApiSecurityScheme
                    {
                        Type = OpenApiSecuritySchemeType.OAuth2,
                        Flow = OpenApiOAuth2Flow.AccessCode
                    }));
            });

[sreedharbestha]

Hi espenrl, my application is AspNet OWIN based application (not AspNetCore). My app references NSwag.AspNet.Owin v13.1.5 pakage.

I setup swagger using NSwag IAppBuilder.UseSwaggerUi3 extension like below:

app.UseSwaggerUi3(
                webApiAssembly,
                settings =>
                {
                    settings.GeneratorSettings.DefaultPropertyNameHandling = PropertyNameHandling.CamelCase;
                    settings.GeneratorSettings.Title = appName;

                    settings.GeneratorSettings.IsAspNetCore = false;

                    settings.OAuth2Client = new OAuth2ClientSettings
                    {
                        ClientId = clientId, 
                        AppName = appName,
                        AdditionalQueryStringParameters =
                        {
                            {"audience", audience}
                        },
                        UsePkceWithAuthorizationCodeGrant = true
                    };

                    settings.GeneratorSettings.OperationProcessors.Add(
                        new OperationSecurityScopeProcessor("bearer"));

                    settings.GeneratorSettings.DocumentProcessors.Add(new SecurityDefinitionAppender("bearer",
                        new OpenApiSecurityScheme()
                        {
                            Type = OpenApiSecuritySchemeType.OAuth2,
                            Flow = OpenApiOAuth2Flow.AccessCode,
                            Scopes = new Dictionary<string, string> {{audience, audience}},
                            AuthorizationUrl = authorizationUrl,
                            TokenUrl = tokenUrl
                        }));
                });

[espenrl]

The code modification is specific for ASP.NET Core. The same code will have to be replicated for ASP.NET. See #2480

I do not have a setup for ASP.NET on my computers. I have abandoned those hefty SDKs.

If you find usePkceWithAuthorizationCodeGrant: true in /swagger/index.html source then third party SwaggerUI is in control and it should work.

[RicoSuter]

I've updated the Swagger UI version in NSwag.AspNet.Owin but the other changes are not made. I personally dont use ASP.NET anymore and do not support it. Please create a PR with the same changes as the ASP.NET Core one.

[sreedharbestha]

Hi Espenrl/RicoSuter, thank you for your quick reply. I've a very limited knowledge on this to do PR. I will create a PR when I figured it out how to do this. Thank you for the all the hard work and bringing this very useful package to us.

[sreedharbestha]

I have managed to create PR for NSwag.AspNet.Owin PKCE support
See #2546