Authenticated requests in Swagger fails with http 401 #10507

7 Answer(s)

• 

  0

  AI-Bot created yesterday

  Support Team ABP Agent

  • This is not an API/auth configuration regression in your app. It’s a known limitation of ABP Studio’s built-in browser: the Swagger UI OAuth/OpenID Connect flow completes visually, but Swagger UI cannot persist/use the access token, so requests are sent without the Authorization: Bearer ... header (exactly like your curl example). As a result, the API challenges the Bearer scheme and you get 401.

  • Fix / Workaround

    1. Do not use ABP Studio’s internal browser for Swagger authentication.
    2. Open Swagger UI in a real browser (Chrome/Edge/Firefox):
       • In ABP Studio Solution Runner, right-click your HttpApi.Host (or gateway) app → Copy Url.
       • Paste the URL into your external browser and open /swagger.
    3. Click Authorize, login, then retry the endpoint. You should now see Swagger sending Authorization: Bearer <token> and the request will succeed.

  • No code changes are required in your solution for this specific issue.

  Link (verified):
  https://abp.io/docs/latest/solution-templates/microservice/api-gateways

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  petri.t created yesterday

  Problem exists also in Edge. I tried also InPrivate window.

  Save Cancel
• 

  0

  maliming created yesterday

  Support Team Fullstack Developer

  hi

  Does your current user have the AbpIdentity.UserLookup permission?

  PermissionRequirement: AbpIdentity.UserLookup"

  Thanks.

  Save Cancel
• 

  0

  petri.t created yesterday

  UserLookup service was bad example, it gives 403 even when authenticated, /api/account-admin/settings is better example. But basically problem is about missing authentication headers and should therefore affect any endpoint requiring authentication.

  I tried to create new solutions with abp cli version 2.1.9 and 2.2.1. 2.1.9 creates solution for abp version 10.0.2 and 2.2.1 for abp version 10.1.0. In version 10.0.2 swagger does send Authentication header and api calls are able to authenticate. In version 10.1.0 swagger doesn't send Authentication header and therefore any api call requiring authentication can't work.

  Here are steps to create solution with version 10.0.2 where swagger works:

  dotnet tool uninstall -g Volo.Abp.Studio.Cli

  dotnet tool install -g Volo.Abp.Studio.Cli --version 2.1.9

  abp new AbpTest219 --tiered

  Open solution in ABP Studio

  • start everything
  • browse HttpApi.Host-project
  • copy url and open it in chrome or edge
  • login to swagger with admin (and correct scope)
  • try any endpoint that requires authentication, for example /api/account-admin/settings
  • swagger sends Authorization header
  • swagger gives http 200 result:

  { "isSelfRegistrationEnabled": true, "enableLocalLogin": true, "preventEmailEnumeration": false }

  And here are steps to create solution with version 10.1.0 where swagger doesn't work:

  dotnet tool uninstall -g Volo.Abp.Studio.Cli

  dotnet tool install -g Volo.Abp.Studio.Cli --version 2.2.1

  abp new AbpTest221 --tiered

  Open solution in ABP Studio

  • start everything
  • browse HttpApi.Host-project
  • copy url and open it in chrome or edge
  • login to swagger with admin (and correct scope)
  • try any endpoint that requires authentication, for example /api/account-admin/settings
  • swagger doesn't Authorization header
  • swagger gives http 401 result

  I tried to update the project from ABP Studio to latest version (10.1.1), the same problem still exists. But if I upgrade the project to preview version 10.2.0-rc.2 (requires migration), swagger works again.

  So there seems to be problem in both versions 10.1.0 and 10.1.1, that swagger doesn't send authentication header.

  For me the workaround could be continuing temporarily with preview version, but this seems like a bug in version 10.1 and I don't like to see this problem reappearing in final version of 10.2.

  Save Cancel
• 

  0

  algrou created 16 hours ago

  I m facing the same issue, I just created a new project, and I noticed swagger is not sending the authorization header with the request. did you find a solutions for this ?

  Save Cancel
• 

  0

  maliming created 4 hours ago

  Support Team Fullstack Developer

  hi

  I will check it.

  Thanks.

  Save Cancel
• 

  0

  maliming created 4 hours ago

  Support Team Fullstack Developer

  hi

  This issue has been identified and fixed. It was caused by a scheme name mismatch introduced during the Swashbuckle v10.0 upgrade in ABP 10.1.

  The AddAbpSwaggerGenWithOidc method defines the security scheme as "oidc", but the security requirement incorrectly references "oauth2". This mismatch causes Swagger UI to fail to attach the Bearer token to API requests after authorization.

  Fix PR: https://github.com/abpframework/abp/pull/25071

  Workaround until the patch is released:

  Override the security requirement in your AddAbpSwaggerGenWithOidc setup action:

  context.Services.AddAbpSwaggerGenWithOidc(
      configuration["AuthServer:Authority"]!,
      scopes: new[] { "YourProjectName" },
      setupAction: options =>
      {
          options.SwaggerGeneratorOptions.SecurityRequirements.Clear();
          options.AddSecurityRequirement(document => new OpenApiSecurityRequirement()
          {
              [new OpenApiSecuritySchemeReference("oidc", document)] = []
          });
      });
  

  Thanks.

  Save Cancel