title: GitHub OAuth2 and Swagger UI
body: <p>I am trying to use the Swagger UI with OAuth2 authentication.
  I am using GitHub as OAuth2 provider.
  OpenAPI specification is configured as follows:</p>
  <pre><code>security:
    - github-oauth2:
        - read:user
  components:
    securitySchemes:
      github-oauth2:
        type: oauth2
        description: GitHub OAuth2
        flows:
          authorizationCode:
            authorizationUrl: https://github.com/login/oauth/authorize
            tokenUrl: /github/login/oauth/access_token
            scopes:
              read:user: Read user info
  </code></pre>
  <p>When I click the icon to authenticate the following popup is opened:</p>
  <p><a href="https://i.stack.imgur.com/vfeGM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vfeGM.png" alt="OAuth2 authentication" /></a></p>
  <p>When I click &quot;Authorize&quot; I can see that the following Ajax call is executed:</p>
  <pre><code>curl 'https://github.com/login/oauth/access_token' \
    -H 'Accept: application/json, text/plain, */*' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    --data-raw 'grant_type=authorization_code&amp;code=e84fe8fbcfc14f3ea7eb&amp;client_id=20352f8b20b8b15760e7&amp;client_secret=xxxxxxx&amp;redirect_uri=https%3A%2F%2Flocalhost%2Foauth2-redirect.html' \
    --compressed \
    --insecure -D - -o output.txt
  </code></pre>
  <p>The response code is 200 but the body contains an error:</p>
  <pre><code>error=bad_verification_code&amp;error_description=The+code+passed+is+incorrect+or+expired.&amp;error_uri=https%3A%2F%2Fdocs.github.com%2Fapps%2Fmanaging-oauth-apps%2Ftroubleshooting-oauth-app-access-token-request-errors%2F%23bad-verification-code
  </code></pre>
  <p>The header of the response is:</p>
  <pre><code>Date: Sat, 07 Nov 2020 21:13:03 GMT
  Content-Type: application/x-www-form-urlencoded; charset=utf-8
  Transfer-Encoding: chunked
  Server: GitHub.com
  Status: 200 OK
  Vary: X-PJAX
  ETag: W/&quot;247b44249fccede96d6031934fdd6443&quot;
  Cache-Control: max-age=0, private, must-revalidate
  Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
  X-Frame-Options: deny
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
  Expect-CT: max-age=2592000, report-uri=&quot;https://api.github.com/_private/browser/errors&quot;
  Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
  Vary: Accept-Encoding, Accept, X-Requested-With
  Vary: Accept-Encoding
  X-GitHub-Request-Id: E67D:B003:F0125B:1586D8A:5FA70DDF
  </code></pre>
  <p>I am not sure what I am doing wrong.</p>