将基本身份验证添加到swagger ui，以便锁定文档页面

Question

.Net Framework 4.6.1，类库项目（Web API）

我已经将swagger/swashbuckle nuget添加到项目中，并将SwaggerConfig.cs文件添加到我的App_Start文件夹中。

SwaggerConfig.cs的剪报

using System.Web.Http;
using WebActivatorEx;
using MyService;
using Swashbuckle.Application;

[assembly: PreApplicationStartMethod(typeof(SwaggerConfig), "Register")]

然后我继续注册服务

public class SwaggerConfig
{
    public static void Register()
    {
        var thisAssembly = typeof(SwaggerConfig).Assembly;

        GlobalConfiguration.Configuration
            .EnableSwagger(c =>
                {
                    c.SingleApiVersion("v1", "My API");
                    c.IncludeXmlComments(string.Format(@"{0}\swaggerdoc.XML",
                       System.AppDomain.CurrentDomain.BaseDirectory));
                    c.BasicAuth("basicauth").Description("Basic HTTP Authentication");
                })
            .EnableSwaggerUi(c =>
                {
                });
    }
}

但是我不确定在哪里设置了查看文档所需的用户名/密码。API方法都使用令牌进行认证，但是我试图添加一个安全层，通过使用基本的认证来阻止随机用户浏览API文档。

Answer 1

要使用基本身份验证保护您的swagger doc，您需要在SwaggerConfig.cs文件中启用它，并在文档或操作级别将其与相应的“安全”属性相结合。

请注意以下来自 SwaggerConfig 的完整注释.cs用于启用基本身份验证：

// You can use "BasicAuth", "ApiKey" or "OAuth2" options to describe security schemes for the API.
// See https://github.com/swagger-api/swagger-spec/blob/master/versions/2.0.md for more details.
// NOTE: These only define the schemes and need to be coupled with a corresponding "security" property
// at the document or operation level to indicate which schemes are required for an operation. To do this,
// you'll need to implement a custom IDocumentFilter and/or IOperationFilter to set these properties
// according to your specific authorization implementation
//
c.BasicAuth("basic").Description("Basic HTTP Authentication");

如何将其与相应的“安全”属性耦合？您可以添加一个类来实现该过滤器：

public class SwaggerHeaderFilter : IOperationFilter
{

    public void Apply(Operation operation, SchemaRegistry schemaRegistry, ApiDescription apiDescription)
    {
        var filterPipeline = apiDescription.ActionDescriptor.GetFilterPipeline();
        // check if authorization is required
        var isAuthorized = filterPipeline
            .Select(filterInfo => filterInfo.Instance)
            .Any(filter => filter is IAuthorizationFilter);
        // check if anonymous access is allowed
        var allowAnonymous = apiDescription.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Any();
        if (isAuthorized && !allowAnonymous)
        {
            if (operation.security == null)
                operation.security = new List<IDictionary<string, IEnumerable<string>>>();
            var auth = new Dictionary<string, IEnumerable<string>>
                 {
                    {"basic", Enumerable.Empty<string>()}
                };
            operation.security.Add(auth);
        }
    }
}

在swaggerConfig.cs文件中，将其添加到配置中:

c.OperationFilter<SwaggerHeaderFilter>();

并且不要忘记使用[Authorize]标签装饰您的Api

参考：https://codingsight.com/swashbuckle-swagger-configuration-for-webapi/

Answer 2

如果你想保护文档，你必须在Web服务器本身上做到这一点，对于.net 4.x，我假设IIS。

您使用的方法旨在告诉Swagger显示用户名/密码登录表单，以使用这些带有基本HTTP授权标头的凭据调用服务endpoint。