Search code examples
springdoc

SpringDoc Oauth2 Implicit flow nonce parameter required and auth fails

I am able to enable the authorize button, but when I click on the authorize button, for oauth2 implicit flow it complains that the nonce parameter is missing.

The 'nonce' parameter is required for authorize requests with either the 'id_token' or 'token' response types

This is the code that I use to create the implicit flow

new OpenAPI()
    .addSecurityItem(new SecurityRequirement().addList(securitySchemeName))
    .components(new Components()
        .addSecuritySchemes(securitySchemeName,
            new SecurityScheme()
                .name(securitySchemeName)
                .type(SecurityScheme.Type.OAUTH2)
                .description("This API uses OAuth 2 with the implicit grant flow.")
                .flows(new OAuthFlows()
                          .implicit(new OAuthFlow()
                              .authorizationUrl(authorizeUri)
                              .scopes(new Scopes()
                                .addString("read", "read")))

In Springfox to add the nonce parameter you create a bean for SecurityConfiguration and use the additionalQueryStringsParams() method.

SecurityConfiguration#additionalQueryStringParams()

where you would add nonce as the key and a random string in the value pair. I tried using the extensions on OAuthFlows and SecurityScheme, but it still doesn't seem to be working.

I am not sure what I am missing, any help is appreciated.

Solution

  • Ok I figured it out, there is no function to add extra query params. You just have to hardcode it into the string yourself so add it to the url.

    .authorizaitonUrl(authroizeUri + "?nonce=\"asdf\"")