Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • O openapi-generator
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3,476
    • Issues 3,476
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 402
    • Merge requests 402
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • OpenAPI Tools
  • openapi-generator
  • Issues
  • #2077
Closed
Open
Issue created Feb 06, 2019 by Administrator@rootContributor

[REQ][Python] Python client Cookie authentication should be transparent

Created by: tomghyselinck

Is your feature request related to a problem? Please describe.

In summary: Cookie authentication is currently not "transparent" to the API user. We need to set the cookie ourselves once authenticated to the server.

  1. We use cookie authentication in an OpenApi 3.0 spec.
  2. We generate a Python client
  3. Perform a "login" operation on the REST API (using the openapi_client.DefaultApi.login_post() call).
  4. The REST server responds with a Set-Cookie HTTP header.
  5. For successful authentication, the API user must now set the value of openapi_client.ApiClient.cookie with the value obtained from the "HTTP headers" returned by openapi_client.DefaultApi.login_post_with_http_info() call.

See also an example in #2075 (closed) or in attachment: python-cookie-auth.zip

Generate Python client code using:

./python-cookie-auth.sh

Describe the solution you'd like

When the REST API server returns a Set-Cookie HTTP header, the ApiClient should handle it properly:

  1. E.g. 'Set-Cookie': 'FULL_ACCESS_TOKEN=123; HttpOnly; Path=/; SameSite=Strict' should set the FULL_ACCESS_TOKEN cookie
  2. E.g. 'Set-Cookie': 'FULL_ACCESS_TOKEN=; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Max-Age=0; Path=/' should unset the FULL_ACCESS_TOKEN cookie

I suppose the openapi_client.ApiClient.__call_api (or any function it calls) should handle incoming Set-Cookie headers and update openapi_client.ApiClient.cookie value accordingly.

Considerations

When multiple cookie authentications are defined in the OpenAPI (3.0) description file, you should considered to extend the support to multiple cookies. For example make openapi_client.ApiClient.cookie a dict of cookie names to values.

Secondly, the API server can also send cookies which are not used for authentication. Those can either be filtered out if not useful or also added to the cookie dict and used just as is.

Describe alternatives you've considered

At this moment we set the openapi_client.ApiClient.cookie value once we received it.

Additional context

Assignee
Assign to
Time tracking