Swagger-ui: Basic authentication header not send through "Try it out" operation

[gabriel-detassigny]

Hi,

I was trying to use Basic Authentication in Swagger-UI, using the latest master version.

The Authorize button works fine : it shows me a form for basic authentication to set username and password.

However, when I try API endpoints with the "Try it out" button, it doesn't send the corresponding Authorization HTTP header. Am I doing anything wrong? My spec seems ok as far as I can tell.

{
    "swagger": "2.0",
    "info": {
        "title": "API",
        "description": "Internal API",
        "version": "1.0"
    },
    "host": "localhost",
    "basePath": "/",
    "schemes": [
        "http"
    ],
    "produces": [
        "application/json; versions=1"
    ],
    "paths": {
        "/account": {
            "get": {
                "tags": [
                    "account"
                ],
                "summary": "Get the current user account information",
                "responses": {
                    "200": {
                        "description": "User info"
                    }
                },
                "security": [
                    {
                        "login": []
                    }
                ]
            }
        }
    },
    "definitions": {},
    "securityDefinitions": {
        "login": {
            "type": "basic",
            "description": "Basic authentication"
        }
    }
}

Please let me know if you need any more details!

[fehguy]

Security definitions declare "what" security exists. It doesn't say "where" to apply them. Add a "security" attribute with the name of the scheme (login in your case) on the operations which require it.

[gabriel-detassigny]

There is already a security attribute, if you look at the /account endpoint:

"security": [
      {
           "login": []
      }

[webron]

@fehguy - I've asked @gabriel-detassigny to open this ticket coming from another one. Tested it and it indeed doesn't work.

[FlaxHaxx]

I have the same problem when using the latest master version. Clicking the "Try it out!" button doesn't send the Authorization header that was set using the form.

[fehguy]

OK I've reproduced this. Looks like the security is named basic instead of login when authorizing. I'll send a PR and update this issue.

[sontrananh]

i have same problem when using swagger ui 3.0.18. Clicking the "Excute" button doesn't send the Authorization header that was set using the form.

[toddsingleton]

I'm experiencing this same problem in v3.1.7. @sontrananh, were you able to find a workaround?

[webron]

Commenting on a closed ticket that was opened on an entirely different version of the project - isn't going to help. If you have an issue, please open a new ticket.

[sontrananh]

@toddsingleton: i had that problem because i deploy swagger in a server but i deploy service in another server with different ip. And i disable csrf check of browers to fix it