Show Authorization Header in UI

[tiwari-abhishek]

I have protected all my APIs with oAuth and need to be able to pass Access Token to the API through Authorization header in the try out UI. How can I do that? as of now I just have the Controller methods showing up which wont actually work without the header being passed.

Any help appreciated.

[billzhuang]

i also want to know how to implement this issue, i did not use OAuth, i just need pass a customized key in header, currently my workround is run below method in console
swaggerUi.api.clientAuthorizations.add("key", new SwaggerClient.ApiKeyAuthorization("x-accesskey", "eeee", "header"));

but is there any trick i can let me input header in swagger UI

[adamfisher]

I also need this. https://github.com/swagger-api/swagger-ui#header-parameters shows how to add it in swagger but I'm not seeing a way to do it from the config in Swashbuckle.

[jskrepnek]

Use an operation filter.

public class AddAuthorizationHeaderParameterOperationFilter: IOperationFilter
    {
        public void Apply(Operation operation, SchemaRegistry schemaRegistry, ApiDescription apiDescription)
        {
            var filterPipeline = apiDescription.ActionDescriptor.GetFilterPipeline();
            var isAuthorized = filterPipeline
                                             .Select(filterInfo => filterInfo.Instance)
                                             .Any(filter => filter is IAuthorizationFilter);

            var allowAnonymous = apiDescription.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any();

            if (isAuthorized && !allowAnonymous)
            {
                operation.parameters.Add(new Parameter {
                    name = "Authorization",
                    @in = "header",
                    description = "access token",
                    required = true,
                    type = "string"                    
                });
            }
        }
    }

Then add this filter to the configuration:

httpConfig
.EnableSwagger("docs/{apiVersion}", config => {
config.SingleApiVersion("v1", "api")
config.OperationFilter<AddAuthorizationHeaderParameterOperationFilter>();
})
.EnableSwaggerUi(config => {
config.DocExpansion(DocExpansion.Full);
 });

[MarwaAhmed]

I want to add the: "AddAuthorizationHeaderParameterOperationFilter" to specific service methods.
for ex: api/students ---> uses that certain header key-value.
and i want to add the basic authentication in a certain service method;
for ex: api/authenticate --> this uses basic http authentication.

any suggestions? thanks in advance.

[MarwaAhmed]

okay, i've figured it out. I'm just writing the solution in case if anyone faced it.

in "AddAuthorizationHeaderParameterOperationFilter"; "Apply" method:

var myTokenAttribute = apiDescription.GetControllerAndActionAttributes<MyToken>().Any();

//note: i wrote the attribute above a controller and sometimes above an actionmethod.
Then:

 if (myTokenAttribute)
 {           
     if (operation.parameters == null)
     {
          operation.parameters = new List<Parameter>();
      }            
      operation.parameters.Add(new Parameter()
      {
           name = "Authorization Token",
           @in = "header",
            description = "my token description",
            required = true,
            type = "string"
        });
   }

[domaindrivendev]

Nice - this is similar to what I would have recommended.

I'm not familiar with your implementation of MyToken, but I'm guessing it's just a "marker" attribute that has no effect on the actual implementation.

Although it's not always possible, I try to implement operation filters that are bound to actual implementation so you get "living" documentation. For example, I use the WebApi "Authorize" attribute to enforce authorization and then have an operation filter that includes the relevant header parameter if operation's are decorated with that attribute. This way, the documentation always reflects the actual behavior.

[MarwaAhmed]

@domaindrivendev: Yes, MyToken is an attribute which checks if the api's user is logged in & has a sessionId. Waiting for your documentation example; this is going to be very helpful. Would you please include http basic authentication with an actual example as well? Thank you.

[adamfisher]

Wow thank you but I am still having an issue with it returning any data once I add the filter.

I'm waiting on issue #329 to be resolved so I can debug with Fiddler. How does it layout the header exactly? I am expecting it to output this:

Authorization: Bearer sdjfniwebwdfmsdkf.sdfnuwehefunwienfwef.wefuweiufwenfwenf

I am integrating with the JwtForWebApi library and I would like the Authentication token field to appear any time I decorate [Authorize] on a controller or action method. This is what I have so far.

public void Apply(Operation operation, SchemaRegistry schemaRegistry, ApiDescription apiDescription)
{
    var filterPipeline = apiDescription.ActionDescriptor.GetFilterPipeline();
    var isAuthorized = filterPipeline.Select(filterInfo => filterInfo.Instance).Any(filter => filter is IAuthorizationFilter);
    var authorizationRequired = apiDescription.GetControllerAndActionAttributes<AuthorizeAttribute>().Any();

    if (isAuthorized && authorizationRequired)
    {
        operation.parameters.Add(new Parameter
        {
            name = "Authorization Token",
            @in = "header",
            description = "JWT security token obtained from the service method Login.",
            required = true,
            type = "string"
        });
    }
}

[jskrepnek]

@adamfisher

Did you register the filter?, like so

httpConfig
.EnableSwagger("docs/{apiVersion}", config => {
config.SingleApiVersion("v1", "api");
config.OperationFilter<AddAuthorizationHeaderParameterOperationFilter>();
})

If you did, when you step through the Apply method, are you seeing expected values for isAuthorized and authorizationRequired? You're determining this differently compared to the solution I shared above.

Also, the 'name' of the parameter should be just 'Authorization' rather than 'Authorization Token'.

[MarwaAhmed]

Yes, correction: 'Authorization Basic' and 'Authorization: Basic' are not valid HTTP header fields names.
This work out if:

 name = "Authorization"

but in the swagger UI, the api's user could pass: basic or whatever the used token name.
here's mine:

[adamfisher]

That worked for me. Thanks guys!

[deepakvij]

Great post. Saved me a lot of time, thanks!!

[johnkors]

@domaindrivendev How's this going to work when we're using owin middleware to define how authorization works for our APIs? The [Authorize] attribute only says that it's in need of auth, not how it's done.

[Sandiejat]

@johnkors - Did you figure out a way to do that?
When I try the above solutions authorizationRequired is null in
var authorizationRequired = apiDescription.ActionDescriptor.GetCustomAttributes().Any();

[johnkors]

No,sorry. We document the auth process outside Swagger now.

[MrOnyancha]

I have failed to add the operation filter. any guidance please...

[hsfoggia]

In Vb.NET

Public Class AddAuthTokenHeaderParameter
Implements IOperationFilter

Public Sub Apply(operation As Operation, schemaRegistry As SchemaRegistry, apiDescription As ApiDescription) Implements IOperationFilter.Apply

    Dim filterPipeline = apiDescription.ActionDescriptor.GetFilterPipeline()
    Dim isAuthorized = filterPipeline.Select(Function(s) s.Instance).Any(Function(sc) sc.GetType().Equals(GetType(UnisyncAuthorizeAttribute)))

    Dim allowAnonymous = apiDescription.ActionDescriptor.GetCustomAttributes(Of AllowAnonymousAttribute)().Any()

    If isAuthorized And (Not allowAnonymous) Then
        If operation.parameters Is Nothing Then
            operation.parameters = New List(Of Parameter)
        End If
        operation.parameters.Add(New Parameter With {
                .name = "Authorization",
                .in = "header",
                .description = "access token",
                .required = True,
                .type = "string"
            })
    End If

End Sub

End Class