Configuring global request parameters

[hjpbarcelos]

Could we have a way for declaring global request parameters?

I'm working on an aggregation API that has its own authentication method. What I do is just to forward an Authentication header to these APIs that will handle the authentication.

Currently, I have to set:

    parameters:
        - name: authorization
        in: header
        description: The user access token
        required: true

in every request.

Is there an easy way to include a option that allows us to configure global request parameters? I'm pretty sure I'm not the only one with this need. Some coleagues of mine have worked with swagger some time ago and they told me they had faced the same issue.

Suggestions I have for this:

1. Having an wildcard entry on paths:

   *:
       post:
           parameters:
               - name: authorization
                 in: header
                 description: The user access token
                 required: true
       get:  
           parameters:
               - name: authorization
                 in: header
                 description: The user access token
                 required: true

   It could be very repetitive if we needed to set the parameters for every request method.

2. Having an wildcard entry on paths that allows global path and global method configuration:

   *:
       *:
           parameters:
               - name: authorization
                 in: header
                 description: The user access token
                 required: true
       post:
           parameters:
               - name: another_one
                 in: body
                 description: Something
                 required: true

   This way, we could set global parameters for every method and refining if needed.

There should also be a way to ignore these global configurations, such as:

/signin:
    post:
        parameters:
            - name: username
            # ...
        use_global_parameters: false

Also, there should be possible to overwrite the global configurations, like:

*:
    *:
        parameters:
            - name: something
                in: query
                description: something
                required: true
    post:
        parameters:
            - name: something
                in: body
                description: Something
                required: true

[webron]

I don't believe we're going to support global parameters so quickly. That's the bad news. The good news is that authorization gets special treatment anyways and there's a way to declare security schemes globally. I just updated the security sections in the spec yesterday/today (depending on your TZ) which allows you to declare a security header or query parameter that needs to be sent with the request.

https://github.com/wordnik/swagger-spec/blob/master/versions/2.0.md#swaggerSecurityDefinitions
https://github.com/wordnik/swagger-spec/blob/master/versions/2.0.md#swaggerSecurity

By the way, this is not new to 2.0 and could have been done in previous versions as well.

[hjpbarcelos]

So, as far as I understood, the security scheme type I should use to solve my problem (just to pass the Authentication header around) is apiKey. Am I right?

[webron]

That is correct.

[hjpbarcelos]

Ok, I'll look into it. Thank you =].

[hjpbarcelos]

Hi @webron

I have this defined in the global swagger-spec:

securityDefinitions:
  forwarded:
    name: authorization
    type: apiKey
    in: header

  /profiles/me:
    x-swagger-router-controller: profile
    get:
      security:
        - passaporte:
          - forwarded
      description: Gets the information about the current user
      operationId: me

How can I obtain the security params?

Thank you,

[webron]

I'm not sure what you mean by that question...

[hjpbarcelos]

I am sorry. Let me try to put this another way.

My problem is the the same of the first post in this thread: I need to forward an authorization header to another API.

This is repeated across almost every API entry, but the authentication and refresh authentication ones.

Right now, I'm doing it in an operation-base:

    parameters:
        - name: authorization
          in: header
          description: The user access token
          required: true

Now I'm trying to remove this and use the security object, but I need access to the security parameters in order to forward them, but I couldn't find a way of doing so.

[webron]

What do you mean access and forward them? Swagger is for documentation, there's no 'action' behind it.

[hjpbarcelos]

When I'm passing a header as a parameter, I'm able to access it like:

function someExpressRouteCallback(req, res) {
    var authorization = req.params.swagger.authorization.value;
}

What I'm asking is if there's a way of obtaining the value of this authorization header when I configure it as a security definition.

[webron]

This is using which library?

[hjpbarcelos]

Oh, I see now. This is not defined here. Sorry about that.
I'm using apigee-127, maybe I should ask them how to do this.
Sorry to bother you.

[webron]

Hehe, yeah. They may have not had the chance to implement it yet, but you should bring it up with them.

[shatestest]

@webron can you please help me how to access apiKey at url after setting it. https://stackoverflow.com/questions/49050969/setting-swagger-apikey-in-version-3-0

[deepan-itela]

Is it possible to set a default apikey value like the one below.

securityDefinitions:
  forwarded:
    name: authorization
    type: apiKey
    in: header
    default: myapikey

I tried this, but it doesn't work.

[StephanBijzitter]

I've got a few headers that are always sent back, and every request path has got multiple possible status codes, especially because >= 400 ranges are documented too.

I've got a few hundred of these repeating:

Can this issue be re-opened?