swagger-api / swagger-api/swagger-ui
Swagger UI is not challenging with Basic Auth to the openAPI endpoint
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
I have a JAX-RS application, and we are using OpenAPI/Swagger to view all the APIs. I want to protect the OpenAPI Endpoint with Basic Auth (URL: http://localhost:8090/openapi). On the first request to the endpoint, I am setting the response header with 'WWW-Authenticate' and the value 'Basic realm="XXXX"'. This is working fine if I open the URL in the chrome browser PFA chrome.jpg. However, if I open the same URL in Swagger UI, it is not challenging with a username and password and showing 401 page PFA swagger.jpg.
Response Header from Swagger
Content-Security-Policy:default-src 'none'; frame-ancestors 'none'
Content-Type:application/json
Referrer-Policy:strict-origin-when-cross-origin
Strict-Transport-Security:max-age=31536000
WWW-Authenticate: Basic realm="XXXX"
X-Content-Type-Options:nosniff
X-Frame-Options:SAMEORIGIN
X-Xss-Protection:1
Accept:application/json,/
Q&A (please complete the following information)
- OS: Windows
- Browser: Chrome
- Version: 120.0.6099.217 (Official Build) (64-bit)
- Method of installation: NA
- Swagger-UI version: 5.11.0
- Swagger/OpenAPI version: OpenAPI 3.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the request to http://localhost:8090/openapi through Swagger UI 5.11.0 and compare it with the same URL in Chrome. Start from the OpenAPI endpoint request and its WWW-Authenticate: Basic realm="XXXX" response; done means Swagger UI handles the protected endpoint as expected instead of displaying a 401 page.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, openapi
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100