Authorization for the inital fetching of swagger spec file

[gmarziou]

Hello,

I'm using 2.1.1, I have the same problem as reported and fixed in swagger-api/swagger-js#445 which is that our swagger spec file is not publicly accessible, you have to be authenticated and so the request to get the spec file must have an X-auth-token HTTP header.

i tried to do the same way as addApiKeyAuthorization() in index.html but it can't work because window.swaggerUi.api is not yet defined, it gets defined after window.swaggerUi.load(); which loads the spec file.

So, is there a way to add authorizations before the spec gets loaded?

Thanks

[tcompiegne]

Same question here, is it possible to add field "headers" to the SwaggerUi object, something like that

  window.swaggerUi = new SwaggerUi({
        url: url,
        headers: {
           Authorization : Basic .....,
           .....
       },
        dom_id: "swagger-ui-container",
        supportedSubmitMethods: ['get', 'post', 'put', 'delete', 'patch'],
        onComplete: function(swaggerApi, swaggerUi){
        .....
}

Thanks

[we-zhang]

Has the same question.

From the documentation here https://github.com/swagger-api/swagger-ui, looks like we can use "authorizations" option to fetch the swagger spec, original quoting as:

authorizations
An authorization object to be passed to swagger-js. Setting it here will trigger inclusion of any authorization or custom signing logic when fetching the swagger description file. Note the object structure should be { key: AuthorizationObject }

But what is the right JSON structure for {key : AuthorizationObject}, tried a few times without lucky.

[fehguy]

you cannot add headers directly when initializing the swaggerUi. You should be using this syntax:

      window.swaggerUi = new SwaggerUi({
        url: url,
        dom_id: "swagger-ui-container",
        authorizations: {
          fun: new SwaggerClient.ApiKeyAuthorization("api_key", 'abcdefg', "header")
        },

This will apply the api_key header when loading the spec.

[we-zhang]

@fehguy Thanks, and this is working well.

But this setting is not only for loading swagger doc, it also applies to the real API calls.

It would be better if has separate setting for loading swagger and API calls since sometimes the the authorization of API calls is different from loading swagger spec.

[fehguy]

Define a security requirement on your API then. If there is none, then any authorization will apply. If there is a security requirement defined, and the name is different from the one you use to fetch the spec, it won't be used.

[dinvlad]

Could you comment how to achieve that in version 3 of the UI? Thanks

[webron]

Please follow #2793.