Java Community | Help. Code. Learn.•2y ago

Swagger 2 is not launching. Keep getting 401 Unauthorized error

I can't launch swagger on my

http://localhost:8080/swagger-ui/

http://localhost:8080/swagger-ui/

http://localhost:8080/swagger-ui/

http://localhost:8080/swagger-ui/. Web browser shows that the page isn't working and writes 401 error:
I'm using Spring Boot v3.0.5. And Spring Security 6.0.2.
Dependencies:

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-boot-starter</artifactId>
            <version>3.0.0</version>
        </dependency>
        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

JavaBot•2/23/24, 10:52 AM

⌛⌛ This post has been reserved for your question.

Hey @Tomasm21! Please use
/close
/close
or the Close PostClose Post button above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.

TIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here.

Tomasm21OP•2/23/24, 10:53 AM

I'm sure Spring Security is blocking it.
I was trying to find solution on the Internet and most sources mention to add URIs as permitted request matchers:

private static final String[] AUTH_WHITE_LIST = {
            "/v3/api-docs/**",
            "/swagger-ui/**",
            "/v2/api-docs/**",
            "/swagger-resources/**"
    };
    
    @Bean
    protected Docket api() {
        return new Docket(DocumentationType.SWAGGER_2)
                .select()
                .paths(PathSelectors.any())
                .apis(RequestHandlerSelectors.basePackage("soft.project.demo"))
                .build()
                .securitySchemes(Arrays.asList(apiKey()))
                .securityContexts(Arrays.asList(securityContext()))
                .apiInfo(apiInfo());
    }

private static final String[] AUTH_WHITE_LIST = {
            "/v3/api-docs/**",
            "/swagger-ui/**",
            "/v2/api-docs/**",
            "/swagger-resources/**"
    };
    
    @Bean
    protected Docket api() {
        return new Docket(DocumentationType.SWAGGER_2)
                .select()
                .paths(PathSelectors.any())
                .apis(RequestHandlerSelectors.basePackage("soft.project.demo"))
                .build()
                .securitySchemes(Arrays.asList(apiKey()))
                .securityContexts(Arrays.asList(securityContext()))
                .apiInfo(apiInfo());
    }

Tomasm21OP•2/23/24, 10:53 AM

    private ApiKey apiKey() {
        return new ApiKey("JWT", "Authorization", "header");
    }

    private SecurityContext securityContext() {
        return SecurityContext.builder().securityReferences(defaultAuth()).build();
    }

    private List<SecurityReference> defaultAuth() {
        AuthorizationScope authorizationScope = new AuthorizationScope("global", "accessEverything");
        AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
        authorizationScopes[0] = authorizationScope;
        return Arrays.asList(new SecurityReference("JWT", authorizationScopes));
    }

        @Bean
    protected SecurityFilterChain configureAuthorization (HttpSecurity http) throws Exception{            
        return http.cors(cors -> corsFilter()).csrf(csrf -> csrf.disable())
                .authorizeHttpRequests(auth -> auth
                .requestMatchers(AUTH_WHITE_LIST).permitAll()
                .requestMatchers("/api/auth/**", "/api/verify", "/api/users/createReader").permitAll()
                .anyRequest().authenticated())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(exception -> exception.authenticationEntryPoint((request, response, ex) -> {
                       response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ex.getMessage());
                }))
                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)    
                .build();
    }
    
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().requestMatchers(AUTH_WHITE_LIST);
    }

    private ApiKey apiKey() {
        return new ApiKey("JWT", "Authorization", "header");
    }

    private SecurityContext securityContext() {
        return SecurityContext.builder().securityReferences(defaultAuth()).build();
    }

    private List<SecurityReference> defaultAuth() {
        AuthorizationScope authorizationScope = new AuthorizationScope("global", "accessEverything");
        AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
        authorizationScopes[0] = authorizationScope;
        return Arrays.asList(new SecurityReference("JWT", authorizationScopes));
    }

        @Bean
    protected SecurityFilterChain configureAuthorization (HttpSecurity http) throws Exception{            
        return http.cors(cors -> corsFilter()).csrf(csrf -> csrf.disable())
                .authorizeHttpRequests(auth -> auth
                .requestMatchers(AUTH_WHITE_LIST).permitAll()
                .requestMatchers("/api/auth/**", "/api/verify", "/api/users/createReader").permitAll()
                .anyRequest().authenticated())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(exception -> exception.authenticationEntryPoint((request, response, ex) -> {
                       response.sendError(HttpServletResponse.SC_UNAUTHORIZED, ex.getMessage());
                }))
                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)    
                .build();
    }
    
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().requestMatchers(AUTH_WHITE_LIST);
    }

But it all doesn't help.
Maybe anyone of you knows what to do? How to make Swagger available through Spring Security?

JavaBot•2/23/24, 4:00 PM

💤💤 Post marked as dormant

This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping/help ping.
Warning: abusing this will result in moderative actions taken against you.

Swagger 2 is not launching. Keep getting 401 Unauthorized error

Similar Threads

Similar Threads

Similar Threads