Search code examples
corsswaggerswagger-editor

Swagger Editor Not Passing Authorization in the Request Header

I'm using Swagger Editor for the first time to test an API. I'm running it locally. My authorization is working, but my first GET path schema keeps returning "Failed to fetch" errors.

When I run the Swagger generated Curl code in GitBash, I get the result I expect, so everything I need is in the schema. I just can't get the response when I run it in Swagger Editor.

As far as I can tell, Swagger Editor is not including the Authorization token in the Request Header. Here is the request from my browser console... enter image description here

I understand that this may be a CORS issue - but I'm not a server admin and I don't have access to make changes to the server. Is there something I need to tell the server admins? Or is there something that I need to change on my local machine to include the authorization code with the header request? My server admin says that CORS is properly enabled.

The odd thing is that if I copy the CURL string that is generated by Swagger Editor, and paste it into GitBash, it runs properly and I get the result I expect. Here's the CURL sting...

enter image description here

If it helps, here is my Swagger JSON.

{  
   "swagger":"2.0",
   "info":{  
      "description":"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Morbi molestie sem nec nibh blandit efficitur. Donec arcu massa, semper ut mauris eu, fermentum dictum turpis. [Test Link](http://google.com) Duis efficitur at sapien non maximus. ",
      "version":"1.0.0",
      "title":"LA-API",
      "termsOfService":"http://swagger.io/terms/",
      "contact":{  
         "email":"[email protected]"
      },
      "license":{  
         "name":"Apache 2.0",
         "url":"http://www.apache.org/licenses/LICENSE-2.0.html"
      }
   },
   "host":"betaapi.myDomain.com",
   "basePath":"/",
   "tags":[  
      {  
         "name":"Account",
         "description":"First try at adding LA-API Swagger paths",
         "externalDocs":{  
            "description":"Find out more",
            "url":"http://swagger.io"
         }
      }
   ],
   "schemes":[  
      "http"
   ],
   "securityDefinitions":{
      "la-api_auth":{  
         "type":"oauth2",
         "tokenUrl":"http://betaauthorize.myDomain.com/access_token",
         "flow":"password",
         "scopes":{  
            "write:la":"Lorem ipsum",
            "read:la":"Dolor sit amet"
         }
      },
      "api_key":{  
         "type":"apiKey",
         "name":"Authorization",
         "in":"header"
      }
   },
   "paths":{
      "/api/account/{account_id}":{  
         "get":{  
            "tags":[  
               "Account"
            ],
            "summary":"Account - View",
            "description":"Lorem ipsum dolor sit amet, consectetur adipiscing elit.",
            "operationId":"AccountView",
            "produces":[  
               "application/json"
            ],
            "parameters":[
               {  
                  "name":"account_id",
                  "in":"path",
                  "description":"ID of Account to return",
                  "required":true,
                  "type":"integer",
                  "format":"int64"
               }
            ],
            "security":[  
               {  
                  "la-api_auth":[  
                     "write:la",
                     "read:la"
                  ]
               }
            ],
            "responses":{  
               "200":{  
                  "description":"successful operation"
               },
               "400":{  
                  "description":"Invalid Account ID supplied"
               },
               "401":{
                  "description":"Authorization token is required and has failed or has not yet been provided"
               },
               "404":{  
                  "description":"Account ID not found"
               }
            }
         }
      }
   },
   "definitions":{  
      "Account":{
         "type":"object",
         "properties":{
            "sms_id":{  
               "type":"integer",
               "format":"int64",
               "example":"370"
            },
            "address1":{  
               "type":"string",
               "example":"123%"
            },
            "city":{  
               "type":"string",
               "example":"Test%"
            },
            "state_id":{  
               "type":"string",
               "example":"TN"
            }
         }
      },
      "ApiResponse":{  
         "type":"object",
         "properties":{  
            "code":{  
               "type":"integer",
               "format":"int32"
            },
            "type":{  
               "type":"string"
            },
            "message":{  
               "type":"string"
            }
         }
      }
   },
   "externalDocs":{  
      "description":"Find out more about Swagger",
      "url":"http://swagger.io"
   }
}

Any advice would be appreciated. Thanks.

Solution

  • Going by this resource: https://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0

    OPTIONS requests should exclude user credentials, so should also not respond with a 401 by the server.