Swagger2/Open API Swagger UI support request

[quantum-fusion]

Updated to reflect results of deep dive

• Framework version: 0.9.1
• Implementations: Spring Boot

Scenario

• Servlet request handler cannot work with wrapper responses:

javax.servlet.ServletException: java.lang.ClassCastException: org.springframework.boot.web.support.ErrorPageFilter$ErrorWrapperResponse cannot be cast to com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletResponse
at 

• Servlet forward fails for spring boot default error pages, response buffer is already flushed

---

Original issue description

I am interested in having Swagger2 support for Swagger UI with Sam local running Lambda SpringBoot.
https://springframework.guru/spring-boot-restful-api-documentation-with-swagger-2/

I tried to add the Swagger UI, however there is a conflict with SAM local security and the server times out, because of security authentication that fails.

It appears that the SAM Local security conflicts with the Swagger2 UI security being disabled, and the SAM Local security proxy wins, therefore disabling Swagger2 UI.

Expected behavior

This example shows the Swagger UI being enabled in this Spring Boot project.

1.)
https://github.com/quantum-fusion/springboot_swagger_example-master-cassandra

Actual behavior

This Lambda example shows that the Swagger UI is disabled, in this SpringBoot project.
2.)
https://github.com/quantum-fusion/aws-serverless-java-container/blob/master/samples/springboot/pet-store/README.md

Steps to reproduce

Run both springboot projects both 1.) and 2.)

Full log output

[sapessi]

Are you trying to serve the HTML for Swagger UI from a Lambda function? What does SAM local have to do with this?

[quantum-fusion]

Sam local has nothing to do with the Swagger that generates HTML and CSS portion.

The security mechanism that is used with Swagger I found was conflicting with the Sam local proxy security. In fact the MVC portion of spring boot used with Lambda was requiring a login user name and password, which in fact without Lambda is not a requirement.

I have provided two examples, one with Swagger, and one without. The lambda example does not have swagger support, but it would be nice to have it.

I can provide and reproduce a test case that provides a failing result, with Swagger integrated into the Lambda example.

Otherwise, you can look at the two test cases, and let me know what you think.

[quantum-fusion]

To answer your question, No, I am not specifically trying to generate swagger from a lambda function, however given that the SpringBoot controller allows a plurality of controllers, it could be construed that perhaps a Lamba set of controllers would generate swagger UI, with HTML, and CSS.

[davidmco65]

The way I've resolved what I think you're trying to do is use a maven plugin to generate the Swagger from our code (which then I automatically augment to import directly into API Gateway) and then use Enunciate to create static HTML and publish to an S3 bucket. Let me know if you'd like more details.

David

[quantum-fusion]

Yes, I am very interested, in that I think Swagger will help developer productivity, and at our AWS meetup group Lambda is of great interest.

Do you have a GitHub repo that I can take a look at , so that I can try to adopt changes across projects? If you have a new standard way of doing this, I am trying to offer a consistent way to do this with Spring Boot and JAVA.

[davidmco65]

Hi, sorry for the delay, I lost this thread...

I'm in the process of publishing this now. It's a little specific to my setup, but feel free to customize. It will be at https://github.com/davidmco65/APIGatewaySwaggerUtils.

Thanks,
David

[sapessi]

Let me see if I can get to the bottom of this. This library, and API Gateway + Lambda, are capable of returning static HTML content. Generating and returning a Swagger UI as an HTML page from the Lambda function should work fine.

Generating Swagger from the code is a very interesting idea. However, as @davidmco65 mentioned, it is a task better performed at compile time. It is not a core feature I'd want to build into the runtime framework. Perhaps we have a case here for building a CLI utility for this framework.

Can you tell me a little bit more about what the issue is with SAM local security? I can look into the SAM local code to find the issue if you can elaborate on this @quantum-fusion: "The security mechanism that is used with Swagger I found was conflicting with the Sam local proxy security."

[quantum-fusion]

I will jump on this, and get you a test case to reproduce the failure case.

[quantum-fusion]

The use case, is like this, Spring Boot applications can support the Swagger2 maven plugin

When the Swagger2 plugin is integrated within a SpringBoot project, that uses Lambda, the Swagger2 plugin that generates HTML, has a timeout with SAM local, due to a security authorization that times out with the SAM local proxy security.

[sapessi]

ok. So when you build a project with the Swagger2 maven plugin it packages correctly. However, when you try to run it in SAM local, the application does not respond?

What I want to clarify is, the plugin works at compile time and builds successfully, the issue happens when you try and load the page. Is that only through SAM local or also on Lambda + API GW?

[quantum-fusion]

Yes, the project compiles correctly.

The problem is found at runtime, when the swagger ui plugin is called to generate the page.

The page is not accessible, due to spring security requiring a login token

I have found noticeable differences between your Lambda Spring Boot example, and mine, the main difference is that the spring security token in your project is missing and is not shown in the console logs.

The issue happens when you try to load the page, and the security token is required for login and password by spring security. This does not normally occur in a project without Lambda with Spring Boot standalone. The reason is that Swagger over rides the security, and allows all incoming requests to be authorized without a login token from spring security.

I believe that Sam Local shows that the service times out, with the AWS proxy, because of the need for a spring security token. I do not know why it thinks it wants a login name and password for spring security, it appears that the over ride for the swagger plugin is disabled when integrated with SAM local and the proxy. I do not know why it does this.

[quantum-fusion]

I can recreate this scenario, or allow you to do the integration yourself. Let me know if you want me to reproduce, or if you want to go through the integration steps to see for your self.

[sapessi]

If you have a repo with the Swagger plugin enabled that I just grab, package, and test with SAM local send me the link - it would save me a lot of time and ensure that I replicate exactly what you are doing

[quantum-fusion]

Yes, I will do this, and give it to you after lunch in about an hour.

I would ask that you do a thorough code review, because there may be a couple things that I am missing.