OAuth2 request adds vendorExtension scope to all auth requests

[janslow]

When I try to obtain an OAuth2 token using Swagger UI, it displays a vendorExtensions scope in the list of scopes for that definition. It also then adds it to the list of scopes in the request from the OAuth server (which causes the request to be rejected).

For example, using the following security definition produces this URL, even if only the my-scope scope is selected:

http://nimbus.corefiling.com/oauth/authorize?response_type=token&redirect_uri=X&realm=X&client_id=X…ent_id=nimbus-dev&scope=my-scope%20vendorExtensions&state=X

securityDefinitions:
  oauth2:
    type: oauth2
    flow: implicit
    authorizationUrl: https://my-oauth2-server/oauth/authorize
    scopes:
      my-scope: A Scope

I believe this is related to swagger-api/swagger-js#869, which added a vendorExtensions object to the scopes object.

[frol]

I experience the same issue as well! #2397 (comment)

[frol]

@fehguy Could you, please, elaborate your vision on this issue as it was your commit to Swagger-Client which triggered this bug?

[a-tal]

thanks @frol, your patch works for us 👍