Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do you turn off swagger-ui in production

I have swagger plugged in to my spring boot application. Spring boot allows you to have property files for each environment that you have. Is there a way to disable swagger for a production environment?

like image 263
user301693 Avatar asked Jun 13 '16 16:06

user301693


People also ask

Should you disable Swagger in production?

We should not enable swagger in production due to security threats. In.net core version 6.0 version, we can protect it with the below code in Program.

How do I change my Swagger UI?

You can change default swagger-ui path programmatically using ApplicationListener<ApplicationPreparedEvent> . The idea is simple - override springdoc. swagger-ui. path=/custom/path before your Spring Boot application starts.

Is there a way to disable Swagger for a production environment?

Spring boot allows you to have property files for each environment that you have. Is there a way to disable swagger for a production environment? Put your swagger configuration into separate configuration class and annotate it with @Profile annotation -> so that it will be scanned into Spring context only in certain profiles.

How do I disable Swagger in Spring Boot?

To disable Swagger in production, let's toggle whether this configuration bean is injected. 3. Using Spring Profiles In Spring, we can use the @Profile annotation to enable or disable the injection of beans. Let's try using a SpEL expression to match the “swagger” profile, but not the “prod” profile:

Is there way to forbid url in Swagger-UI?

/swagger-ui.html still available but there is no methods. Is there way to forbid URL ? I think this is more neater way of enabling swagger on demand, instead of disabling for some profiles.

How to protect Swagger UI page from frame-jacking?

Similarly, take care to defend the Swagger UI page against frame-jacking, e.g., via the X-Frame-Options header. Thanks for contributing an answer to Information Security Stack Exchange!


2 Answers

Put your swagger configuration into separate configuration class and annotate it with @Profile annotation -> so that it will be scanned into Spring context only in certain profiles.

Example:

@Configuration @EnableSwagger2 @Profile("dev") public class SwaggerConfig {     // your swagger configuration } 

You can than define profile your Spring Boot app is operating in via command line: --spring.profiles.active=dev or via config file: spring.profiles.active=dev.

Read this section of Spring Boot docs for more info about @Profile

like image 125
luboskrnac Avatar answered Oct 07 '22 16:10

luboskrnac


If you are working on multiple environments then you can also use @Profile as array

@Configuration @EnableSwagger2 @Profile({"dev","qa"}) public class SwaggerConfig {    // your swagger configuration } 
like image 31
Pervez Avatar answered Oct 07 '22 16:10

Pervez