swagger-api / swagger-api/swagger-ui

Swagger UI is not challenging with Basic Auth to the openAPI endpoint

Open
#9,501 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

I have a JAX-RS application, and we are using OpenAPI/Swagger to view all the APIs. I want to protect the OpenAPI Endpoint with Basic Auth (URL: http://localhost:8090/openapi). On the first request to the endpoint, I am setting the response header with 'WWW-Authenticate' and the value 'Basic realm="XXXX"'. This is working fine if I open the URL in the chrome browser PFA chrome.jpg. However, if I open the same URL in Swagger UI, it is not challenging with a username and password and showing 401 page PFA swagger.jpg.

Response Header from Swagger
Content-Security-Policy:default-src 'none'; frame-ancestors 'none'
Content-Type:application/json
Referrer-Policy:strict-origin-when-cross-origin
Strict-Transport-Security:max-age=31536000
WWW-Authenticate: Basic realm="XXXX"
X-Content-Type-Options:nosniff
X-Frame-Options:SAMEORIGIN
X-Xss-Protection:1
Accept:application/json,/

Q&A (please complete the following information)
  • OS: Windows
  • Browser: Chrome
  • Version: 120.0.6099.217 (Official Build) (64-bit)
  • Method of installation: NA
  • Swagger-UI version: 5.11.0
  • Swagger/OpenAPI version: OpenAPI 3.0
    chrome
    swagger

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the request to http://localhost:8090/openapi through Swagger UI 5.11.0 and compare it with the same URL in Chrome. Start from the OpenAPI endpoint request and its WWW-Authenticate: Basic realm="XXXX" response; done means Swagger UI handles the protected endpoint as expected instead of displaying a 401 page.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, openapi
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.