Swagger UI not working with Basic Authentication // Swagger UI outdated

Hi!

Context

• hapi version: 17.2.0
• hapi-swagger version: 9.0.2
• hapi-auth-basic version: 5.0.0

What are you trying to achieve or the steps to reproduce ?

I have my routes secured with HTTP Basic Authentication using hapi-auth-basic. This is working fine including securing the additional routes generated by hapi-swagger, e.g., /swagger.json, /documentation and static resources.

What I am missing is Swagger UI dealing properly with Basic Authentication.

This is a stripped-down version of my code…

const Hapi = require('hapi');
const HapiSwagger = require('hapi-swagger');
const HapiAuthBasic = require('hapi-auth-basic');

const server = new Hapi.Server({
  routes: { //  route options -> default configuration for every route
    auth: 'simple',
  },
  ...
});

const swagger = {
  plugin: HapiSwagger,
  options: {
    auth: 'simple',
    ...
    securityDefinitions: {
      simple: {
        type: 'basic',
      },
    },
    security: [{
      simple: [],
    }],
  },
};

const provision = async () => {
  try {
    // authentication
    await server.register({ plugin: HapiAuthBasic });
    server.auth.strategy('simple', 'basic', { validate });
    server.auth.default('simple');
    // other plugins
    await server.register([
      ...
      api,
      swagger,
      ...
    ]);
    await server.start();
  } catch (error) {
    console.error(error); // eslint-disable-line no-console
    process.exit(1);
  }
};

provision();

What result did you get?

The generated Swagger UI page (/documentation), however, ignores the security settings of the API and calls the API endpoints (Button “Try it out!”) without setting the Authorization header or displaying any input field for user credentials. The API will, of course, respond with HTTP 401.

The provided /swagger.json does actually include securityDefinitions and security from the plug-in options:

{
  ...
  "schemes": [
    "http"
  ],
  "security": [{
    "simple": []
  }],
  "securityDefinitions": {
    "simple": {
      "type": "basic"
    }
  },
  "swagger": "2.0",
  "tags": []
}

What did you expect ?

Swagger UI sending Authorization header with API requests and/or some means in the UI to set username and password.

Is there anything I am doing wrong? Or is this a bug?

Thanks for your help.

[frankthelen]

My current approach / workaround is this: I am using hapi-swagger to serve /swagger.json and hapi-swaggered-ui to serve the Swagger page. It’s using Swagger UI version 3.9.1 which is correctly dealing with the authentication settings. Very nice.

const HapiSwagger = require('hapi-swagger');
const HapiSwaggerUI = require('hapi-swaggered-ui');

const swagger = {
  plugin: HapiSwagger,
  options: {
    documentationPage: false,
    ...
  },
};

const swaggerUI = {
  plugin: HapiSwaggerUI,
  options: {
    path: '/documentation',
    swaggerEndpoint: '/swagger.json',
    ...
  },
};

...

await server.register(swagger);
await server.register(swaggerUI);

...

[robmcguinness]

Closed in v10.0.0