Skip to content

[csharp][generichost] Multiple oauth tokens #23264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devhl-labs wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[csharp][generichost] Multiple oauth tokens #23264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...nerator/src/main/resources/csharp/libraries/generichost/DependencyInjectionTests.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,8 @@ namespace {{packageName}}.Test.{{apiPackage}}

{{/httpSignatureMethods}}
{{#oauthMethods}}
OAuthToken oauthToken = new{{^net70OrLater}} OAuthToken{{/net70OrLater}}("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken);
OAuthToken oauthToken{{-index}} = new{{^net70OrLater}} OAuthToken{{/net70OrLater}}("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken{{-index}});

{{/oauthMethods}}
{{/lambda.trimTrailingWithNewLine}}
Expand Down
11 changes: 11 additions & 0 deletions ...urces/3_0/csharp/petstore-with-fake-endpoints-models-for-testing-with-http-signature.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,9 @@ paths:
- petstore_auth:
- 'write:pets'
- 'read:pets'
- petstore_auth2:
- 'write:pets'
- 'read:pets'
requestBody:
$ref: '#/components/requestBodies/Pet'
put:
Expand Down Expand Up @@ -1430,6 +1433,14 @@ components:
scopes:
'write:pets': modify pets in your account
'read:pets': read your pets
petstore_auth2:
type: oauth2
flows:
implicit:
authorizationUrl: 'http://petstore.swagger.io/api/oauth/dialog'
scopes:
'write:pets': modify pets in your account
'read:pets': read your pets
api_key:
type: apiKey
name: api-key
Expand Down
11 changes: 11 additions & 0 deletions samples/client/petstore/csharp/generichost/net10/FormModels/api/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ paths:
- petstore_auth:
- write:pets
- read:pets
- petstore_auth2:
- write:pets
- read:pets
summary: Add a new pet to the store
tags:
- pet
Expand Down Expand Up @@ -3116,6 +3119,14 @@ components:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
petstore_auth2:
flows:
implicit:
authorizationUrl: http://petstore.swagger.io/api/oauth/dialog
scopes:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
api_key:
in: header
name: api-key
Expand Down
2 changes: 1 addition & 1 deletion samples/client/petstore/csharp/generichost/net10/FormModels/docs/apis/PetApi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ void (empty response body)

### Authorization

[petstore_auth](../README.md#petstore_auth), [http_signature_test](../README.md#http_signature_test)
[petstore_auth](../README.md#petstore_auth), [petstore_auth2](../README.md#petstore_auth2), [http_signature_test](../README.md#http_signature_test)

### HTTP request headers

Expand Down
3 changes: 3 additions & 0 deletions ...etstore/csharp/generichost/net10/FormModels/src/Org.OpenAPITools.Test/Api/ApiTestsBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaul
string oauthTokenValue1 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
OAuthToken oauthToken1 = new(oauthTokenValue1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);
string oauthTokenValue2 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Second OAuth token registration overwrites the first because AddTokens registers a singleton TokenContainer per token type, so only one OAuthToken is retained and both are loaded from the same config key.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/csharp/generichost/net10/FormModels/src/Org.OpenAPITools.Test/Api/ApiTestsBase.cs, line 79:

<comment>Second OAuth token registration overwrites the first because AddTokens registers a singleton TokenContainer per token type, so only one OAuthToken is retained and both are loaded from the same config key.</comment>

<file context>
@@ -76,6 +76,9 @@ public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaul
                 string oauthTokenValue1 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
                 OAuthToken oauthToken1 = new(oauthTokenValue1, timeout: TimeSpan.FromSeconds(1));
                 options.AddTokens(oauthToken1);
+                string oauthTokenValue2 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
+                OAuthToken oauthToken2 = new(oauthTokenValue2, timeout: TimeSpan.FromSeconds(1));
+                options.AddTokens(oauthToken2);
</file context>
Fix with Cubic

OAuthToken oauthToken2 = new(oauthTokenValue2, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
}
}
16 changes: 14 additions & 2 deletions ...rp/generichost/net10/FormModels/src/Org.OpenAPITools.Test/Api/DependencyInjectionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
})
.Build();

Expand All @@ -67,8 +70,11 @@ public class DependencyInjectionTest
HttpSignatureToken httpSignatureToken1 = new(config1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(httpSignatureToken1);

OAuthToken oauthToken = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken);
OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
})
.Build();
Expand Down Expand Up @@ -96,6 +102,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
})
.Build();
Expand Down Expand Up @@ -123,6 +132,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
});
})
Expand Down
12 changes: 9 additions & 3 deletions ...es/client/petstore/csharp/generichost/net10/FormModels/src/Org.OpenAPITools/Api/PetApi.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,14 +847,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc

oauthTokenLocalVar1.UseInHeader(httpRequestMessageLocalVar, "");

HttpSignatureToken httpSignatureTokenLocalVar2 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
OAuthToken oauthTokenLocalVar2 = (OAuthToken) await OauthTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: AddPetAsync requests two OAuth tokens from the same provider with no discriminator and applies both to the Authorization header, so the second UseInHeader call overwrites the first. The client still cannot send two distinct OAuth credentials for two schemes.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/csharp/generichost/net10/FormModels/src/Org.OpenAPITools/Api/PetApi.cs, line 850:

<comment>AddPetAsync requests two OAuth tokens from the same provider with no discriminator and applies both to the Authorization header, so the second UseInHeader call overwrites the first. The client still cannot send two distinct OAuth credentials for two schemes.</comment>

<file context>
@@ -847,14 +847,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc
                     oauthTokenLocalVar1.UseInHeader(httpRequestMessageLocalVar, "");
 
-                    HttpSignatureToken httpSignatureTokenLocalVar2 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
+                    OAuthToken oauthTokenLocalVar2 = (OAuthToken) await OauthTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
 
-                    tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
</file context>
Fix with Cubic


tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
tokenBaseLocalVars.Add(oauthTokenLocalVar2);

oauthTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, "");

HttpSignatureToken httpSignatureTokenLocalVar3 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);

tokenBaseLocalVars.Add(httpSignatureTokenLocalVar3);

if (httpRequestMessageLocalVar.Content != null) {
string requestBodyLocalVar = await httpRequestMessageLocalVar.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);

httpSignatureTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
httpSignatureTokenLocalVar3.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
}

string[] contentTypes = new string[] {
Expand Down
11 changes: 11 additions & 0 deletions samples/client/petstore/csharp/generichost/net10/NullReferenceTypes/api/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ paths:
- petstore_auth:
- write:pets
- read:pets
- petstore_auth2:
- write:pets
- read:pets
summary: Add a new pet to the store
tags:
- pet
Expand Down Expand Up @@ -3136,6 +3139,14 @@ components:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
petstore_auth2:
flows:
implicit:
authorizationUrl: http://petstore.swagger.io/api/oauth/dialog
scopes:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
api_key:
in: header
name: api-key
Expand Down
2 changes: 1 addition & 1 deletion ...client/petstore/csharp/generichost/net10/NullReferenceTypes/docs/apis/PetApi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ void (empty response body)

### Authorization

[petstore_auth](../README.md#petstore_auth), [http_signature_test](../README.md#http_signature_test)
[petstore_auth](../README.md#petstore_auth), [petstore_auth2](../README.md#petstore_auth2), [http_signature_test](../README.md#http_signature_test)

### HTTP request headers

Expand Down
3 changes: 3 additions & 0 deletions ...csharp/generichost/net10/NullReferenceTypes/src/Org.OpenAPITools.Test/Api/ApiTestsBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaul
string oauthTokenValue1 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
OAuthToken oauthToken1 = new(oauthTokenValue1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);
string oauthTokenValue2 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Both OAuth tokens are built from the same configuration key and OAuthToken has no scheme identifier, so multiple OAuth schemes cannot be distinguished and share one token value.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/csharp/generichost/net10/NullReferenceTypes/src/Org.OpenAPITools.Test/Api/ApiTestsBase.cs, line 79:

<comment>Both OAuth tokens are built from the same configuration key and OAuthToken has no scheme identifier, so multiple OAuth schemes cannot be distinguished and share one token value.</comment>

<file context>
@@ -76,6 +76,9 @@ public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaul
                 string oauthTokenValue1 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
                 OAuthToken oauthToken1 = new(oauthTokenValue1, timeout: TimeSpan.FromSeconds(1));
                 options.AddTokens(oauthToken1);
+                string oauthTokenValue2 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
+                OAuthToken oauthToken2 = new(oauthTokenValue2, timeout: TimeSpan.FromSeconds(1));
+                options.AddTokens(oauthToken2);
</file context>
Fix with Cubic

OAuthToken oauthToken2 = new(oauthTokenValue2, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
}
}
16 changes: 14 additions & 2 deletions ...ichost/net10/NullReferenceTypes/src/Org.OpenAPITools.Test/Api/DependencyInjectionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
})
.Build();

Expand All @@ -67,8 +70,11 @@ public class DependencyInjectionTest
HttpSignatureToken httpSignatureToken1 = new(config1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(httpSignatureToken1);

OAuthToken oauthToken = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken);
OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
})
.Build();
Expand Down Expand Up @@ -96,6 +102,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
})
.Build();
Expand Down Expand Up @@ -123,6 +132,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
});
})
Expand Down
12 changes: 9 additions & 3 deletions ...t/petstore/csharp/generichost/net10/NullReferenceTypes/src/Org.OpenAPITools/Api/PetApi.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -849,14 +849,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc

oauthTokenLocalVar1.UseInHeader(httpRequestMessageLocalVar, "");

HttpSignatureToken httpSignatureTokenLocalVar2 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
OAuthToken oauthTokenLocalVar2 = (OAuthToken) await OauthTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);

tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
tokenBaseLocalVars.Add(oauthTokenLocalVar2);

oauthTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, "");
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Second OAuth token overwrites the first because both calls use Authorization without a scheme identifier, so multiple OAuth credentials aren’t actually sent.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/csharp/generichost/net10/NullReferenceTypes/src/Org.OpenAPITools/Api/PetApi.cs, line 856:

<comment>Second OAuth token overwrites the first because both calls use Authorization without a scheme identifier, so multiple OAuth credentials aren’t actually sent.</comment>

<file context>
@@ -849,14 +849,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc
-                    tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
+                    tokenBaseLocalVars.Add(oauthTokenLocalVar2);
+
+                    oauthTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, "");
+
+                    HttpSignatureToken httpSignatureTokenLocalVar3 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
</file context>
Fix with Cubic


HttpSignatureToken httpSignatureTokenLocalVar3 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);

tokenBaseLocalVars.Add(httpSignatureTokenLocalVar3);

if (httpRequestMessageLocalVar.Content != null) {
string requestBodyLocalVar = await httpRequestMessageLocalVar.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);

httpSignatureTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
httpSignatureTokenLocalVar3.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
}

string[] contentTypes = new string[] {
Expand Down
11 changes: 11 additions & 0 deletions samples/client/petstore/csharp/generichost/net10/Petstore/api/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ paths:
- petstore_auth:
- write:pets
- read:pets
- petstore_auth2:
- write:pets
- read:pets
summary: Add a new pet to the store
tags:
- pet
Expand Down Expand Up @@ -3136,6 +3139,14 @@ components:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
petstore_auth2:
flows:
implicit:
authorizationUrl: http://petstore.swagger.io/api/oauth/dialog
scopes:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
api_key:
in: header
name: api-key
Expand Down
2 changes: 1 addition & 1 deletion samples/client/petstore/csharp/generichost/net10/Petstore/docs/apis/PetApi.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ void (empty response body)

### Authorization

[petstore_auth](../README.md#petstore_auth), [http_signature_test](../README.md#http_signature_test)
[petstore_auth](../README.md#petstore_auth), [petstore_auth2](../README.md#petstore_auth2), [http_signature_test](../README.md#http_signature_test)

### HTTP request headers

Expand Down
3 changes: 3 additions & 0 deletions .../petstore/csharp/generichost/net10/Petstore/src/Org.OpenAPITools.Test/Api/ApiTestsBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ public static IHostBuilder CreateHostBuilder(string[] args) => Host.CreateDefaul
string oauthTokenValue1 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
OAuthToken oauthToken1 = new(oauthTokenValue1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);
string oauthTokenValue2 = context.Configuration["<token>"] ?? throw new Exception("Token not found.");
OAuthToken oauthToken2 = new(oauthTokenValue2, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
}
}
16 changes: 14 additions & 2 deletions ...harp/generichost/net10/Petstore/src/Org.OpenAPITools.Test/Api/DependencyInjectionTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
})
.Build();

Expand All @@ -67,8 +70,11 @@ public class DependencyInjectionTest
HttpSignatureToken httpSignatureToken1 = new(config1, timeout: TimeSpan.FromSeconds(1));
options.AddTokens(httpSignatureToken1);

OAuthToken oauthToken = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken);
OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
})
.Build();
Expand Down Expand Up @@ -96,6 +102,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
});
})
.Build();
Expand Down Expand Up @@ -123,6 +132,9 @@ public class DependencyInjectionTest

OAuthToken oauthToken1 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken1);

OAuthToken oauthToken2 = new("token", timeout: TimeSpan.FromSeconds(1));
options.AddTokens(oauthToken2);
options.AddApiHttpClients(client => client.BaseAddress = new Uri(ClientUtils.BASE_ADDRESS));
});
})
Expand Down
12 changes: 9 additions & 3 deletions samples/client/petstore/csharp/generichost/net10/Petstore/src/Org.OpenAPITools/Api/PetApi.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,14 +847,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc

oauthTokenLocalVar1.UseInHeader(httpRequestMessageLocalVar, "");

HttpSignatureToken httpSignatureTokenLocalVar2 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
OAuthToken oauthTokenLocalVar2 = (OAuthToken) await OauthTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Second OAuth token overwrites the first because UseInHeader always sets the Authorization header; two OAuth requirements cannot both be sent.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/petstore/csharp/generichost/net10/Petstore/src/Org.OpenAPITools/Api/PetApi.cs, line 850:

<comment>Second OAuth token overwrites the first because UseInHeader always sets the Authorization header; two OAuth requirements cannot both be sent.</comment>

<file context>
@@ -847,14 +847,20 @@ public async Task<IAddPetApiResponse> AddPetAsync(Pet pet, System.Threading.Canc
                     oauthTokenLocalVar1.UseInHeader(httpRequestMessageLocalVar, "");
 
-                    HttpSignatureToken httpSignatureTokenLocalVar2 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
+                    OAuthToken oauthTokenLocalVar2 = (OAuthToken) await OauthTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);
 
-                    tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
</file context>
Fix with Cubic


tokenBaseLocalVars.Add(httpSignatureTokenLocalVar2);
tokenBaseLocalVars.Add(oauthTokenLocalVar2);

oauthTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, "");

HttpSignatureToken httpSignatureTokenLocalVar3 = (HttpSignatureToken) await HttpSignatureTokenProvider.GetAsync(cancellation: cancellationToken).ConfigureAwait(false);

tokenBaseLocalVars.Add(httpSignatureTokenLocalVar3);

if (httpRequestMessageLocalVar.Content != null) {
string requestBodyLocalVar = await httpRequestMessageLocalVar.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);

httpSignatureTokenLocalVar2.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
httpSignatureTokenLocalVar3.UseInHeader(httpRequestMessageLocalVar, requestBodyLocalVar, cancellationToken);
}

string[] contentTypes = new string[] {
Expand Down
11 changes: 11 additions & 0 deletions samples/client/petstore/csharp/generichost/net10/SourceGeneration/api/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ paths:
- petstore_auth:
- write:pets
- read:pets
- petstore_auth2:
- write:pets
- read:pets
summary: Add a new pet to the store
tags:
- pet
Expand Down Expand Up @@ -3136,6 +3139,14 @@ components:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
petstore_auth2:
flows:
implicit:
authorizationUrl: http://petstore.swagger.io/api/oauth/dialog
scopes:
write:pets: modify pets in your account
read:pets: read your pets
type: oauth2
api_key:
in: header
name: api-key
Expand Down
Loading
Loading