Swashbuckle.WebApi icon indicating copy to clipboard operation
Swashbuckle.WebApi copied to clipboard

No error when discovery paths are not provided

Open Dekedro opened this issue 7 years ago • 8 comments

Hi, I think I found one Swashbuckle issue. I have a list of documentation paths, so I create SwaggerUiConfig and pass those paths in constructor as discoveryPaths. In order to restrict users to use only these paths I call EnableDiscoveryUrlSelector () on SwaggerUIConfig. It works, a nice drop-down list appears but problem is that I sometimes want to pass empty list of paths. In that case I spotted such Swashbuckle behaviour:

Actual: index.html picks first path from empty list (url: swashbuckleConfig.rootUrl + "/" + swashbuckleConfig.discoveryPaths[0],), it becomes evaluated as undefined and gets passed to swagger-ui. This results that request to .../undefined is executed and it (usually) fails, so discoveryUrlSelector.js isn't loaded. Then it behaves as simple text field, so user can enter any url. capture

Expected: index.html spots that the list of paths is empty, so instead of "Can't read from swagger JSON from .../undefined" it should display a message as "No documentation provided". Url field should be frozen, so user can't type any url.

Dekedro avatar Aug 08 '17 13:08 Dekedro

Why do you sometimes want to pass an empty list of paths?

heldersepu avatar Aug 08 '17 14:08 heldersepu

Well, in my specific case list of paths depends upon user configuration. I'm not the one who controls process of path selection.

Dekedro avatar Aug 08 '17 15:08 Dekedro

Ok, in that case, Why will the user pass an empty list of paths?

heldersepu avatar Aug 08 '17 15:08 heldersepu

I don't want to go deeper into my implementation details but I have no way to prevent users from doing that. Either way, this is Swashbuckle issue since there is no guard against empty list and making request to .../undefined shouldn't be expected behaviour in this case.

Dekedro avatar Aug 08 '17 15:08 Dekedro

Interesting... I guess that Swashbuckle can claim that this is a Swagger-UI issue, Swashbuckle has no way to prevent developers from doing that.

heldersepu avatar Aug 08 '17 16:08 heldersepu

I want to oppose since Swagger-UI does it's job with no flaws - you provide url, swagger-ui tries to execute request. Problem is that Swashbuckle provides incorrect url. I have come up with way to solve this problem:

  1. Swagger-UI shouldn't execute request if list of discoveryPaths is empty. This can be achieved by modifying 'index.html'.
window.swaggerUi.load();

should be changed to

if (swashbuckleConfig.discoveryPaths.length === 0) {
	$("#message-bar").text("No document configured");
} else {
	window.swaggerUi.load();
}
  1. If EnableDiscoveryUrlSelector () is called on SwaggerUiConfig, drop-down list should always appear. Currently it shows up only if request completes successfully. That's because EnableDiscoveryUrlSelector () is threated as javascript injection. From 'SwaggerUIConfig.cs':
public void EnableDiscoveryUrlSelector()
{
	InjectJavaScript(GetType().Assembly, "Swashbuckle.SwaggerUi.CustomAssets.discoveryUrlSelector.js");
}

Solution for this would be:

  • Add boolean like DiscoveryUrlSelectorEnabled to _templateParams (similar as in OAuth2: _templateParams["%(OAuth2Enabled)"] = "true";). Furthermore, in 'index.html' line like
discoveryUrlSelectorEnabled: ('%(DiscoveryUrlSelectorEnabled)' == 'true'),

should be added in window.swashbuckleConfig creation process.

  • 'discoveryUrlSelector.js' should be merged 'index.html', so after window.swaggerUi.load();, logic for drop-down list could be added:
if (swashbuckleConfig.discoveryPaths.length === 0) {
	$("#message-bar").text("No document configured");
} else {
	window.swaggerUi.load();
}

if (swashbuckleConfig.discoveryUrlSelectorEnabled) {
    // Code from discoveryUrlSelector.js
}

I will solve it one way or another, so if you think it's Swashbuckle problem and my solution is acceptable, I can try to fix this and make pull request.

Dekedro avatar Aug 09 '17 06:08 Dekedro

@Dekedro seems that you have a viable solution send a pull request

heldersepu avatar Aug 09 '17 13:08 heldersepu

Let me please point out that problem is still active and actual. F.i. controllers can be auto-generated and generation process depend on some conditions. Endpoints can be a subject for licensing. These cases can lead to the situation when no endpoints are available to the end-user and empty list of swagger paths provided.

sergio-str avatar Sep 08 '22 10:09 sergio-str