oauth2 + passport = Bearer <token>

[pedrofsn]

"Authorization" : "Bearer token213315454Sample"

Is it possible to handle this kind o header in "documentation-swagger"?
If yes, how?

[DarkaOnLine]

It looks like Swagger UI not supporting this:

OAI/OpenAPI-Specification#583
swagger-api/swagger-ui#2234

[joaoBeno]

An way around this issue is specifying the auth as bellow:

 *     @SWG\SecurityScheme(
 *          securityDefinition="default",
 *          type="apiKey",
 *          in="header",
 *          name="Authorization"
 *      )

On the controller, add this:

 *     security={
 *         {
 *             "default": {}
 *         }
 *     }

Then you create a Middleware to append the Bearer , here is a sample:

class SwaggerFix
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (strpos($request->headers->get("Authorization"),"Bearer ") === false) {
            $request->headers->set("Authorization","Bearer ".$request->headers->get("Authorization"));
        }

        $response = $next($request);

        return $response;
    }
}

And then declare it on your Kernel.php:

// I placed it first so it runs before passport's middleware...
protected $routeMiddleware = [
    'swfix' => \App\Http\Middleware\SwaggerFix::class,
]

Now lets wait for Swagger v3 that is said to have oAuth2 support...

[pedrofsn]

Thanks @joaoBeno!

[DarkaOnLine]

Yes these variables are defined in config and passed into the view here: https://github.com/DarkaOnLine/L5-Swagger/blob/master/src/Http/Controllers/ SwaggerController.php#L63-L71

…

On 23 March 2017 at 14:29, ratanakpek ***@***.***> wrote: Hi! Everyone! I need help! I am trying to install L5-swagger, so i follow the command from this L5-swagger <https://github.com/DarkaOnLine/L5-Swagger> but I got errored everytime that I try to open this view that show the swagger. It said that undefined variable: $urlToDocs, $highlightThreshold,... and another variable. I commented the variable error already... for my question is that "How can I give the value to these variable?" in config/l5-swagger file? `<?php if (app()->environment() != 'testing') { header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST'); header("Access-Control-Allow-Headers: X-Requested-With"); } ?> <title>{{config('l5-swagger.api.title')}}</title> <script src='{{config('l5-swagger.paths.assets_public')}}/lib/object-assign-pollyfill.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/jquery-1.8.0.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/jquery.slideto.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/jquery.wiggle.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/jquery.ba-bbq.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/handlebars-2.0.0.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/lodash.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.paths.assets_public')}}/lib/backbone-min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/swagger-ui.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.paths.assets_public')}}/lib/highlight.9.1.0.pack.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/highlight.9.1.0.pack_extended.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/jsoneditor.min.js' type='text/javascript'></script> <script src='{{config('l5-swagger.paths.assets_public')}}/lib/marked.js' type='text/javascript'></script> <script src='{{config('l5-swagger.path s.assets_public')}}/lib/swagger-oauth.js' type='text/javascript'></script> <!-- Some basic translations --> <!-- <script src='lang/translator.js' type='text/javascript'></script> --> <!-- <script src='lang/ru.js' type='text/javascript'></script> --> <!-- <script src='lang/en.js' type='text/javascript'></script> --> <script type="text/javascript"> $(function () { var url = window.location.search.match(/url=([^&]+)/); if (url && url.length > 1) { url = decodeURIComponent(url[1]); } else { {{--url = "{!! $urlToDocs !!}";--}} url ="http://petstore.swagger.io/v2/swagger.json"; } **{{--hljs.configure({--}} {{--highlightSizeThreshold: {{ $highlightThreshold }}--}} {{--});--}}** // Pre load translate... if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); } window.swaggerUi = new SwaggerUi({ url: url, dom_id: "swagger-ui-container", @if(array_key_exists('validatorUrl', get_defined_vars())) // This differentiates between a null value and an undefined variable validatorUrl: {!! isset($validatorUrl) ? '"' . $validatorUrl . '"' : 'null' !!}, @endif supportedSubmitMethods: ['get', 'post', 'put', 'delete', 'patch'], onComplete: function(swaggerApi, swaggerUi){ @if(isset($requestHeaders)) @foreach($requestHeaders as $requestKey => $requestValue) window.swaggerUi.api.clientAuthorizations.add("{{$requestKey}}", new SwaggerClient.ApiKeyAuthorization("{{$requestKey}}", "{{$requestValue}}", "header")); @Endforeach @endif if(typeof initOAuth == "function") { initOAuth({ clientId: "your-client-id", clientSecret: "your-client-secret-if-required", realm: "your-realms", appName: "your-app-name", scopeSeparator: ",", additionalQueryStringParams: {} }); } if(window.SwaggerTranslator) { window.SwaggerTranslator.translate(); } }, onFailure: function(data) { console.log("Unable to Load SwaggerUI"); }, docExpansion: {!! isset($docExpansion) ? '"' . $docExpansion . '"' : '"none"' !!}, jsonEditor: false, apisSorter: "alpha", defaultModelRendering: 'schema', showRequestHeaders: false }); function addApiKeyAuthorization(){ var key = $('#input_apiKey')[0].value; {{--if ("{{$apiKeyInject}}" === "query") {--}} {{--key = encodeURIComponent(key);--}} {{--}--}} {{--if(key && key.trim() != "") {--}} {{--var apiKeyAuth = new SwaggerClient.ApiKeyAuthorization("{{$apiKeyVar}}", key, "{{$apiKeyInject}}");--}} {{--window.swaggerUi.api.clientAuthorizations.add("{{$securityDefinition}}", apiKeyAuth);--}} {{--}--}} } $('#input_apiKey').change(function() { addApiKeyAuthorization(); }); window.swaggerUi.load(); // if you have an apiKey you would like to pre-populate on the page for demonstration purposes // just put it in the .env file, API_AUTH_TOKEN variable ***@***.***($apiKey)--}} {{--$('#input_apiKey').val("{{$apiKey}}");--}} {{--addApiKeyAuthorization();--}} ***@***.***}} }); </script> swagger <http://swagger.io> Explore <#m_-324956319607622765_m_1126979693123509463_> ` — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#57 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABHg8mFYOzSjtVn0OT3DAk7PCDUvZjBtks5romWpgaJpZM4MJGgj> .

[ratanakpek]

Thanks Bro!

[pamaleona-navagis]

where does the middleware should be called?

[joaoBeno]

@pamaleona-navagis if you place this on your Kernel.php:

    // I placed it first so it runs before passport's middleware...
    protected $routeMiddleware = [
        'swfix' => \App\Http\Middleware\SwaggerFix::class,
    ]

It will run on all requests... If they don't have the bearer header, it will get it from the DB and append it to the request, before Passport handle the request...

Ps.: you need to past just the "swfix" line as the first item of the $routeMiddleware array...

[pamaleona-navagis]

I tried putting it on the forst line on the route middleware but unfortunately it doesn't work.

…

On Nov 9, 2017 7:40 AM, "joaoBeno" ***@***.***> wrote: @pamaleona-navagis <https://github.com/pamaleona-navagis> if you place this on your Kernel.php: // I placed it first so it runs before passport's middleware... protected $routeMiddleware = [ 'swfix' => \App\Http\Middleware\SwaggerFix::class, ] It will run on all requests... If they don't have the bearer header, it will get it from the DB and append it to the request, before Passport handle the request... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#57 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AdjxKfYXGFNdod8AJ6W6meT7xE6lfk61ks5s0jwCgaJpZM4MJGgj> .

[joaoBeno]

@pamaleona-navagis, please post your kernel.php on a gist, and post the link here, so I can give you more support without notifying other people... 👍

[pamaleona-navagis]

Here's my Kernel.php https://gist.github.com/pamaleona-navagis/5010be66f1594fb98cea17d3098605af

…

On Thu, Nov 9, 2017 at 5:52 PM, joaoBeno ***@***.***> wrote: @pamaleona-navagis <https://github.com/pamaleona-navagis>, please post your kernel.php on a gist, and post the link here, so I can give you more support without notifying other people... 👍 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#57 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AdjxKRGa0jd9Pkd_FwJnwVlgObdR10Ljks5s0stkgaJpZM4MJGgj> .

[yajra]

Sharing my solution in case it might help.

This is I how made it to work with Passport using password grant. No need for middleware since latest version uses Swagger UI v3.

Note: this snippets assumes that you already completed the passport setup.

1. Add passport security on swagger config

        'passport' => [ // Unique name of security
            'type' => 'oauth2', // The type of the security scheme. Valid values are "basic", "apiKey" or "oauth2".
            'description' => 'Laravel passport oauth2 security.',
            'flow' => 'password', // The flow used by the OAuth2 security scheme. Valid values are "implicit", "password", "application" or "accessCode".
            'tokenUrl' => config('app.url') . '/oauth/token', // The authorization URL to be used for (password/application/accessCode)
            'scopes' => []
        ],

2. Add swagger security scheme Duplicate of step 1, can be skipped as per @DarkaOnLine

 * @SWG\SecurityScheme(
 *   securityDefinition="passport",
 *   type="oauth2",
 *   tokenUrl="/oauth/token",
 *   flow="password",
 *   scopes={}
 * )

3. Include "passport" on your request security:

 * @SWG\Get(
 *   path="/api/user",
 *   tags={"user"},
 *   security={
 *     {"passport": {}},
 *   },
 *   summary="Get user",
 *   @SWG\Response(
 *     response=200,
 *     description="Logged in user info"
 *   )
 * )

4. Generate Docs

5. Authorized the request using the swagger interface and bearer tokens should be added now on secured request.

Request

[DarkaOnLine]

@yajra thanks for sharing.

But I think steps 1 and 2 duplicate each other. You need to use only one of them. Because security definitions in the config file will be generated and appended to the final swagger documentation json file: https://github.com/DarkaOnLine/L5-Swagger/blob/master/src/Generator.php#L46

[yajra]

@DarkaOnLine thanks for pointing that out. Will update my answer and my code. 👍