Swagger-ui: Json fetch request is not fired on authorization/logout

[VladislavSudakov]

Swagger-ui version 3.12.1.

I need to show/hide some endpoints based on the authorization. I.e. after user makes authorization, it should ask server for json and server should return json for authorized user. If user logs out, it should ask for json for anonymous user. To make it happen, swagger-ui should fetch json from server on auth/logout. It worked in prev versions.

Steps to reproduce:

1. Navigate to http://petstore.swagger.io/
2. Click Authorize
3. Fill in api_key auth method with any token and click Authorize, click close.

Expect: swagger-ui should call specActions.download()to download json once again after logged in
Actual: json is not updated

[shockey]

@webron, did we have this in v2? I wouldn't think that authorizations defined in a document should affect the fetching of the document itself.

[webron]

@shockey as much as it doesn't make sense, we had a similar feature. I get why you wouldn't expect it, and I think it was derived as a side effect to the pet store. In fact, currently, some of the pet store is not behaving the way it did with the older version of the UI. That said, I'm not automatically saying we should implement it the same way or at all. We can consider alternative solutions.

[maxnorth]

We actually really need this feature, our api's swagger endpoint uses the auth token to determine which endpoints the user has access to and trims out what they shouldn't be able to see. We always thought this was an intended feature, which we really value. We can't upgrade to V3 until it assists security trimmed swagger docs.

[alexdawes]

+1 - we use this "feature" exactly as @maxnorth does and as such this is blocking us from being able to upgrade to v3.

This is actually a really nice feature to have - an unauthenticated user arrives at the page and sees only the public endpoints, but then if they authenticate themselves with the page then all of the endpoints they have access to appear. This way you can use a single swagger page for regular users, admins, etc.

I would definitely vote to have this available in v3!

[SimonL101]

+1 - same as @maxnorth and @alexdawes. We want to migrate to 3 from 2 but are blocked due to this issue.