The Logout button in Authorize popup not clearing API Key

[vivek201]

Q&A (please complete the following information)

• OS: Windows 8.1
• Browser: Opera, Chrome, Firefox
• Version: 53.0.2907.68
• Method of installation: in Demo at http://petstore.swagger.io

Describe the bug you're encountering

The Authorize Popup is not clearing the apiKey when LogOut button is clicked.

To reproduce...

Steps to reproduce the behavior:

1. Go to http://petstore.swagger.io
2. Click on the Authorize popup
3. Scroll down to the API key section
4. Type a text in the textbox
5. Click on Authorize
6. Without closing the Popup, click on Logout and again Authorize.
7. The APIKey is authorized even though there is nothing in the textbox

Expected behavior

It shouldn't allow to authorize an empty textbox

Screenshots

[heldersepu]

That is debatable... what if I want to allow my api_key to be empty ?

[vivek201]

No, the issue is that the API Key I just entered is still being sent in the header

And the functionality isn't consistent. If you've just opened the popup and you try to enter an empty API Key, you won't be able to do so.

[heldersepu]

Now we are talking!
After logout that key should be gone

[vivek201]

@heldersepu Is there any way I can make the api_key required?

[heldersepu]

@vivek201 I'm sure there is ...
What are we talking about here? your time or my time?

[vivek201]

@heldersepu My time. I've having a hard time figuring out the plugin system setup in swagger ui. Is there any way to use the plugins without having to setup react and webpack in my project?

[heldersepu]

@vivek201 What did you expect? one click done? see it as a badge of honor!
Setting up the environment could be quite challenging, get used to it if you want to code professionally

Now to your question: you don't need the plugins to make the api required, you can do it all with plain javascript & CSS, but this is way of topic, email me directly if you want.

[JeffHare]

I had to add a JS fix to clear the auth key on logout. Otherwise it was still resending the old key in the header with new requests (even when logged out).

[heldersepu]

@JeffHare can you submit a PR with your fix or post your fix here so others can benefit?

[JeffHare]

I did this quite a while back, things have moved on in the project.

Essentially I trimmed the form key input field value and if it was empty I explicitly set it to the empty string to trigger the unauthorized state. Originally there was only action taken when the key changed state to something non-empty. If it changed from having a value to not having a value, nothing was triggered.

Don’t see (only a really quick look) where that fix would apply now. I'm leaving on vacation in a few hours so won’t be able to write tests or really do any of this PR correctly. To make matters a bit more confusing, I was using swagger-ui integrated with Swashbuckle.

[leggsimon]

It seems like this might be a good first issue if someone has the ability to add the label. I don’t mind having a little look through the code to see where the fix should be applied. (and maybe attempting a fix, although if anyone is reading this and I haven’t said otherwise feel free to pick it up)

[leggsimon]

I believe I’ve identified the fix and have a PR incoming