Azure / Azure/azure-functions-openapi-extension
Document about "Configure Authorization Level" is not clear
- Dominant language
- C#
- Stars
- 388
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the issue**
I need to configure the authorization level of my Swagger pages. So, I follow this document [here](https://github.com/Azure/azure-functions-openapi-extension/blob/main/docs/openapi.md#configure-authorization-level).
First, there is a confusion in the name. In the example code block, the variable name is `OpenApi__ApiKey`. But in the text below, it says
`Make sure that you MUST provide the OpenApi__AuthKey value, if you choose the`. So, `ApiKey` or `AuthKey`?
Secondly, how do we query the secured page now? There is no explanation of how to do this. So, I imply that I can use the same method of azure functions. It means `x-functions-key` header or `?code={KEY}` in query string. I tried both, it does not work. The swagger page only returns 401.
**To Reproduce**
Steps to reproduce the behavior:
Configure my local.settings.json (and for Function App on Azure portal as well)
```json
{
"IsEncrypted": false,
"Values": {
"OpenApi__AuthKey": "Test.123",
"OpenApi__AuthLevel__Document": "Function",
"OpenApi__AuthLevel__UI": "Function"
}
}
```
Go to `mysite.com/api/swagger/ui?code=Test.123` --> 401 Error
Go to `mysite.com/api/swagger/ui` with request header `x-functions-key: Test.123` --> 401 Error
**Expected behavior**
The swagger page is secured now. But I should be able to see the page with my given key. It is not clear how I do that.
**Screenshots**

**Environment (please complete the following information, if applicable):**
- OS: Windows
- Browser: Chrome
- Version 100.0.4896.127
Contributor guide
Research direction
Start with docs/openapi.md at the "Configure Authorization Level" section and compare the OpenApi__ApiKey example with the OpenApi__AuthKey text. Reproduce the documented local.settings.json configuration and the two 401 requests, then update the section so the setting name and the way to access a secured Swagger page are consistent and explicit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authentication, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100