Can Swagger render the content of app.UseDeveloperExceptionPage()?

Question

I have an ASP.NET Core 2.0 Web API where I added Swagger via Swashbuckle. Which is nice.

I also have the app.UseDeveloperExceptionPage() option enabled in ASP.NET Core. Which is nice.

But they don't play nice together. Because SwaggerUI just displays the returned HTML as text.

For GET requests it isn't a big problem as I just paste the url into a browser. But for POST that doesn't work. So I was wondering if there was a way to make SwaggerUI render the html when the Content-Type header is text/html. I've been unable to find anything related to this, which is a bit puzzling :)

Answer 1

From the swagger devs:

We have to clean the HTML to avoid injecting tags and enabling XSS vulnerabilities. So yes, raw html is what you should expect to see.

However, you can make the change yourself to swagger-ui.js (code kindly provided by @nicksellen):

--- swagger-ui.js 2015-09-19 20:58:10.000000000 +0200
+++ swagger-ui.js 2015-11-16 13:45:26.958266568 +0100
@@ -31855,9 +31855,10 @@

     // HTML
     } else if (contentType === 'text/html') {
-      code = $('<code />').html(_.escape(content));
-      pre = $('<pre class="xml" />').append(code);
-
+      var iframe = document.createElement('iframe');
+      iframe.srcdoc = content;
+      iframe.style = 'width: 100%; height: 500px;';
+      pre = iframe;
     // Plain Text
     } else if (/text\/plain/.test(contentType)) {
       code = $('<code />').text(content);

To integrate this change using Swashbuckle:

1. Download Swashbuckle from GitHub
2. swagger-ui.js is in the Swashbuckle.AspNetCore.SwaggerUI project in the bower_components\swagger-ui\dist folder. Make the above edits and compile.
3. In your project, remove Swashbuckle NuGet package and add a reference to the DLLs created in step 2.

Since NuGet is no longer managing this package, it will be up to you to periodically check the Swashbuckle project and repeat the process if you want updates.