swagger-api / swagger-api/swagger-ui
How to hide client secret in Swagger Ul for Auth2 client?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
I'm configuring Swagger UI as an OAuth2 client in my Spring application. I see that I'm required to set the client secret using the property: springdoc.swagger-ui.oauth.client_id=secret. However, I want to know if there is a way to hide or protect the client secret in the Swagger UI. Is there a recommended approach to achieve this while still allowing users to authenticate through OAuth2?
I already created an issue https://github.com/springdoc/springdoc-openapi/issues/2737 on the springdoc repo and I was directed here
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Swagger UI's OAuth2 configuration and the springdoc.swagger-ui.oauth.client_id property described in the issue. Determine whether a browser-based Swagger UI flow can protect a client secret, then document the recommended approach or clarify that the requested behavior is unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi, spring
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100