Swashbuckle.aspnetcore: Bearer Token

Created on 16 Jun 2017 · 16Comments · Source: domaindrivendev/Swashbuckle.AspNetCore

I have this configuration:

            services.ConfigureSwaggerGen(x =>
            {
                //x.DocumentFilter
                x.SingleApiVersion(new Info
                {
                    Version = "v1",
                    Title = "API",
                    Description = "API templates for app.",
                    TermsOfService = "None",
                    Contact = new Contact()
                    {
                        Email = "[email protected]",
                        Name = "vendor",
                        Url = "website",
                    },
                    License = new License()
                    {
                        Name = "dd",
                        Url = "https://ddd/support/license"
                    },
                });
                x.IncludeXmlComments(AppContext.BaseDirectory + @"/app.xml");
                x.IgnoreObsoleteProperties();
                x.IgnoreObsoleteActions();
                x.DescribeAllEnumsAsStrings();
                x.AddSecurityDefinition("Bearer", new ApiKeyScheme()
                {
                    Description = "JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
                    Name = "Authorization",
                    In = "header",
                    Type = "apiKey"
                });
            });

There is no provision in UI for input of Bearer token?

Source

mjabian

👍3

Most helpful comment

@mjabian

I tried your solution, fortunately it worked for me with a minor change (not in your code). I used below part of your code

x.AddSecurityDefinition("Bearer", new ApiKeyScheme()
{
    Description = "JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
    Name = "Authorization",
    In = "header",
    Type = "apiKey"
});

It creates an Authorize button in Swagger UI like below for me

When I click this button, it opens up a popup where I was able to put JWT value. It didn't work.

I observed the request using F12 tools and found that the required header was being added but suffix bearer was not added. So, I just put this manually in token value like bearer <token-here>. And, yo, It worked!!.

Thanks a lot to you.

goforgold on 19 Jun 2017

👍26

All 16 comments

As per the Swagger spec, a "security definition" is not enough, you also need to assign applicable operations to the defined scheme. All described in the Swashbuckle readme

domaindrivendev on 17 Jun 2017

@mjabian were you able to achieve this? I need tom implement exactly this.

@domaindrivendev can you please suggest how to do this in ASP.NET Core? any link?

goforgold on 19 Jun 2017

@mjabian

I tried your solution, fortunately it worked for me with a minor change (not in your code). I used below part of your code

x.AddSecurityDefinition("Bearer", new ApiKeyScheme()
{
    Description = "JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
    Name = "Authorization",
    In = "header",
    Type = "apiKey"
});

It creates an Authorize button in Swagger UI like below for me

When I click this button, it opens up a popup where I was able to put JWT value. It didn't work.

Thanks a lot to you.

goforgold on 19 Jun 2017

👍26

@goforgold @mjabian Thanks guys. worked for me!

ross2411 on 13 Oct 2017

This feature is working just for version 1.X not 2.X, so I have downgrade to v1.2 and it is sending the token.

Behnam-Emamian on 20 Mar 2018

I agree, this is not working in 2.X. I also had to downgrade. It looked like the Authorization header was not being included in the request.

ajbeaven on 20 Mar 2018

I can see there is a new UI, so this feature has been broken.

Behnam-Emamian on 20 Mar 2018

@ajbeaven @Behnam-Emamian - to get this to work in 2.x, you need to accompany your scheme _definition_ with a corresponding _requirement_ to indicate that the scheme is applicable to all operations in your API:

c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "Bearer", new string[] { } }
});

__NOTE__: it turns out that the old UI worked without this despite being an incomplete description, as per the Swagger 2.0 spec. The new swagger-ui _correctly_ requires this

domaindrivendev on 20 Mar 2018

👍14 🎉7

YAS! Thank You @domaindrivendev!!

erikcheatham on 23 Mar 2018

Did anyone else figure out why swagger-ui doesn't include the Bearer prefix to the auth token? Or is it expected we provide it on input?

replaysMike on 3 Apr 2018

Hi @replaysMike, it is expected (to my understanding) that the user supplies the "Bearer " prefix along with the JWT Token when pasting it via the Swagger UI.

gakees on 5 May 2018

😕2

services.AddSwaggerGen(options =>
{
    options.AddSecurityDefinition("Bearer", new ApiKeyScheme
    {
        Name = "Authorization",
        In = "header"
    });

    options.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
    {
        { "Bearer", new string[] { } }
    });
});

This did not work for me in version 2.5.0. Has anyone else found a solution to this problem? The "Bearer" word still missing in "Authentication" header request parameter.

jlnpinheiro on 13 Jun 2018

@jlnpinheiro the user must supply that word, as @gakees says.
It's working for me with the same configuration you have, I also added a description to warn the user to write authentication as Bearer {token}

c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "Bearer", new string[] { } }
});

c.AddSecurityDefinition("Bearer", new ApiKeyScheme()
{
    Description = "JWT Authorization header using the Bearer scheme. Example: \"Bearer {token}\"",
    Name = "Authorization",
    In = "header",
    Type = "apiKey"
});