Auth headers not added on multipart/form-data requests

[alexmarchant]

I use 2 header fields to authorize api requests: an auth token + email.

swaggerUi.api.clientAuthorizations.add("authToken", new SwaggerClient.ApiKeyAuthorization("X-API-TOKEN", authToken, "header"));
swaggerUi.api.clientAuthorizations.add("email", new SwaggerClient.ApiKeyAuthorization("X-API-EMAIL", email, "header"));

This works great on all requests except for ones with file uploads that end up being sent multipart/form-data which for some reason don't have the auth headers added in. (normal request headers: http://i.glui.me/1HkQ2ff, multipart request headers: http://i.glui.me/1Ai4Qye)

[webron]

Can you share the definition of the operation with the multipart/form-data?

[alexmarchant]

Sure, here is one of them:

    "/events/{eventId}/information_display/tiles": {
      "post": {
        "tags": [
          "Tiles"
        ],
        "summary": "Create a new text tile",
        "parameters": [
          {
            "name": "eventId",
            "required": true,
            "in": "path",
            "type": "integer"
          }, {
            "name": "type",
            "description": "'text', 'gallery', or 'video'",
            "required": true,
            "in": "formData",
            "type": "string"
          }, {
            "name": "x",
            "required": true,
            "in": "formData",
            "type": "integer"
          }, {
            "name": "y",
            "required": true,
            "in": "formData",
            "type": "integer"
          }, {
            "name": "cols",
            "required": true,
            "in": "formData",
            "type": "integer"
          }, {
            "name": "rows",
            "required": true,
            "in": "formData",
            "type": "integer"
          }, {
            "name": "title",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "subtitle",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "navTitle",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "tileTitle",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "detailTitle",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "body",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "bgColor",
            "required": false,
            "in": "formData",
            "type": "string"
          }, {
            "name": "bgImage[file]",
            "required": false,
            "in": "formData",
            "type": "file"
          }, {
            "name": "bgImage[top]",
            "description": "default 0.5",
            "required": false,
            "in": "formData",
            "type": "number"
          }, {
            "name": "bgImage[left]",
            "description": "default 0.5",
            "required": false,
            "in": "formData",
            "type": "number"
          }, {
            "name": "bgImage[scale]",
            "description": "default 1.0",
            "required": false,
            "in": "formData",
            "type": "number"
          }
        ]
      }
    },

[alexmarchant]

I'm not 100% sure that's what you were looking for here. Let me know if there is something else you wanted?

[webron]

Do you have any security and securityDefinitions in your Swagger description? If so, what and where?

[alexmarchant]

I do have some securityDefinitions, here is the full paste: http://pastebin.com/M8nKBEWh

[webron]

Hmm, the whole Swagger description you shared is not valid, unfortunately. You can't use query parameters in operation paths. While this has nothing to do with the original topic, it is indicative to other possible issues. You also don't mention anywhere in your definition where the security requirements are used. You need to explicitly state that.

[henkosch]

This may be the same issue as #1249
I'm also experiencing this problem with file uploads. The Authorization header is just not added to the request. The header is sent with other requests with no file upload.

[webron]

@henkosch - good catch. Thanks for the reference. I'll close this one as a duplicate then.

@alexmarchant - for the other possible issues (query parameter in path and such), we can continue the general support in the google group.

[alexmarchant]

#1249 does sound a lot like what I'm seeing. Thanks @webron will fix up syntax errors and follow up.