swagger-api / swagger-api/swagger-ui
Change the credentials policy from 'same-origin' to 'include'
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
Is your feature request related to a problem?
The problem is:
My API and Swagger UI are hosted in different domains, and credential is required for some api. I found the credential in cookie is not sent for CORS calls.
I have enabled the CORS on the api server, the crendential is stopped by client (Swagger-UI).
Describe the solution you'd like
Change the credential policy of the featch call from same-origin to include:
https://github.com/swagger-api/swagger-ui/blob/a1e5f2198e41b8c0ceeec57c82adccfabaf694d2/src/core/plugins/download-url.js#L17
Additional context
I'm not sure is there any reason to use same-origin instead of include in Swagger-UI. Consider this UI is used for tecnical cases, there should be no security risk. Is there any special reason to use same-origin option for the crendential?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at src/core/plugins/download-url.js, especially the fetch call at the linked line, and review how its credentials option is currently set. Confirm the desired behavior for Swagger UI requests to APIs on another domain, then verify that the request uses the requested credentials policy when the API permits CORS credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, frontend
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100