The Authorization header carries credentials or authentication information for a requested resource. With bearer-token authorization, a client places a previously issued token in this header on later requests, avoiding repeated authentication. section 9.1.2
For the board-game API, the login endpoint returns a JWT. SwaggerUI can accept that token through an Authorize dialog and attach it to requests before they are sent. section 9.3.1
Configure and verify bearer-token requests by following these steps:
- Add a Bearer security definition in Program.cs with the Authorization header, HTTP bearer scheme, and JWT bearer format. section 9.3.1
- Add a global security requirement so SwaggerUI applies the declared protection to API requests. section 9.3.1
- Click SwaggerUI’s Authorize button, enter the token returned by login, and perform a request to confirm that the header is attached. section 9.3.1
Listing 9.8 Program.cs file: Swagger’s bearer tokens setup
using Microsoft.OpenApi.Models; #1
// ... existing code
builder.Services.AddSwaggerGen(options => {
options.ParameterFilter<SortColumnFilter>();
options.ParameterFilter<SortOrderFilter>();
options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme #2
{
In = ParameterLocation.Header,
Description = "Please enter token",
Name = "Authorization",
Type = SecuritySchemeType.Http,
BearerFormat = "JWT",
Scheme = "bearer"
});
options.AddSecurityRequirement(new OpenApiSecurityRequirement #3
{
{
new OpenApiSecurityScheme
{
Reference = new OpenApiReference
{
Type=ReferenceType.SecurityScheme,
Id="Bearer"
}
},
Array.Empty<string>()
}
});
});
Inspect the concrete Program.cs configuration that defines the Authorization header and enforces bearer-token security in SwaggerUI. section 9.3.1
