swagger-api / swagger-api/swagger-codegen

[Java / Feign] Option to exclude authorization from generated API methods?

Open
#9,005 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Mustache
Stars
17.8k
Forks
6k
PR merge metrics
No merged PRs in 30d

Description

Description

In my swagger specification yml, we apply an Authorization parameter (by ref) to each endpoint. It's strictly an opaque OAuth2 bearer token.

When generating a Java Feign API client (same behavior exhibited in pretty much every swagger library I've tested), the authorization key shows up as a parameter to each API method. However, I'd really like to stick to using an Auth interceptor and not having our developers see these authorization parameters everywhere.

Example of the pervasive authorization header in all API methods:

  @RequestLine("DELETE /installedapps/{id}/subscriptions")
  @Headers({
    "Accept: application/json",
    "Authorization: {authorization}"
  })
  SubscriptionDelete deleteAllSubscriptions(@Param("id") String id, @Param("authorization") String authorization);
Swagger-codegen version

"io.swagger:swagger-annotations:1.5.15"
"io.swagger:swagger-codegen-cli:2.4.0"

Swagger declaration file content or url

Swagger codegen config:

{
    "library": "feign",
    "java8": true
}

Swagger spec example

parameters:
  authorization:
    name: Authorization
    in: header
    description: OAuth token
    required: true
    type: string
    format: string
/installedapps/{id}/subscriptions:
    parameters:
    - $ref: '#/parameters/authorization'
Command line used for generation

Gradle plugin that uses swagger-codegen-cli.

Steps to reproduce
  • Use aforementioned Swagger yaml
  • Generate Java APIs using Feign library
  • Observe that all methods require an authorization param
Related issues/PRs

None found

Suggest a fix/enhancement

Perhaps a template change to turn off authorization params being included in the method signatures.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Feign generation templates and the generated Java method signatures described in the issue, then trace how the Swagger authorization header becomes a method parameter. Define how an option would suppress those parameters while preserving interceptor-based authorization, and verify the behavior by regenerating the example API.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.