Can I use my existing session cookie authentication for my API when testing on swaggerhub?

Question

When I send API requests from SwaggerHub to my API, it seems like the cookie that gets set when I log into my app is not sent. I tried setting "enableCookies: true" in my swagger.yaml API definition - no luck.

What is the best way to do this? FWIW my API spec is here:

https://swaggerhub.com/api/switzer/authenticated-digital-analytics-api/1.0.0

fehguy · Answer

Hi, can you describe what you're trying to do a bit more? &nbsp;How are you&nbsp;logging into your app to get a cookie, and how&nbsp;is SwaggerHub supposed to pass it? &nbsp;If you can explain, we may be able to help.

switzer · Answer

Here are some details:&nbsp;We have a relatively simple Rails application that powers an analytics dashboard. &nbsp;In order to log into the application, a user goes through a login process, and a session cookie is set for this user.&nbsp;When the user requests a dashboard screen, the API is called to get time series data about a given object. &nbsp;This session cookie is passed, and a JSON result is returned. &nbsp;Here is an example of a working script (with the session cookie values modified):&nbsp;curl 'https://app.authenticated.digital/analytics/custom?fields=platform%2Cexchange%2Ctotal&amp;sorts=-total&amp;limit=50&amp;page=1&amp;granularity=all&amp;start_date=2016-06-14&amp;end_date=2016-06-15' -H 'Accept-Encoding: gzip, deflate, sdch, br' -H 'Accept-Language: en-US,en;q=0.8' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.84 Safari/537.36' -H 'Accept: application/json' -H 'Referer: https://app.authenticated.digital/analysis/all/authentic_dsp/' -H 'Cookie: remember_user_token=fjsdlkfjsdlkfjsdlkfjsldkfjsldkfj--dlsdjflsdifjlsdkfjdslkfjsdlf; _admin_session=flkjsdflksdjflksdjflksdjflksdjfldksfjsldkfj--dfkjsdlfkjdsflksdjflksdjfd' -H 'Connection: keep-alive' -H 'Cache-Control: max-age=0' --compressed&nbsp;When SwaggerHub&nbsp;uses XHR to pass in the request, the cookies are not passed, so I receive a 401 not authorized error.&nbsp;I have read in the forums that there may be&nbsp;the ability to pass cookies (e.g. with-credentials: true) by passing in "enableCookies: true" in the Swagger definition file. &nbsp;This does not seem to work.&nbsp;I'd like to be able to set a flag somewhere in the Swagger definition file to instruct XHR to pass cookies with the JSON request.&nbsp;Thanks!&nbsp;P.S. I know that using cookie based authentication is not the preferred method of auth, but one FANTASTIC application of Swagger is to document existing API that may have been written in this way - and I would imagine that a large percentage of API's implement authentication this way. &nbsp;Two popular examples are JIRA and Wordpress.&nbsp;

fehguy · Answer

OK I think I get it--but how&nbsp;are you entering&nbsp;your cookie values from the UI (assuming&nbsp;the interactive UI in swaggerhub)?

switzer · Answer

The auth cookies are set after successful authentication from the UI of our app on (for example) www.mydashboard.com. &nbsp;The cookie domain is for *.mydashboard.com. &nbsp;Therefore, my workflow would be as follows:&nbsp;1. &nbsp;Log into www.mydashboard.com. &nbsp;Auth cookies will be set in the browser.2. &nbsp;Open a new tab and go to swaggerhub.com, and navigate to my API.3. &nbsp;"Try it out" and allow swaggerhub.com to make an XHR request to api.mydashboard.com.&nbsp;The expected behavior is that cookies are sent for this request. &nbsp;They are not being sent because the "withCredentials = true" flag is not being set from the instance of Swagger being hosted at SwaggerHub.&nbsp;More information is here:&nbsp;https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials&nbsp;What I am asking for is the ability to instruct the version of swagger on swaggerhub to modify their XHR request to pass with credentials = true. &nbsp;Perhaps this should be part of the spec?&nbsp;

ponelat · Answer

Hi switzer,&nbsp;I think I might know what's happening...There is an issue with Cookies, that we&nbsp;have&nbsp;an initial ( not ideal ) solution.&nbsp;SwaggerHub.com uses cookies to keep a session active for users. As such, cookies get sent back and forth between the "Try it out" form and the internal proxy ( the proxy is there to circumnavigate CORS issues).Since many servers can be quite strict in what headers they receive, we've had to ensure that our cookie sessions don't follow the request.&nbsp;So our intermediary solution is the Authentication system.If you define a securityDefinition followed by a security in each operation that needs authentication, then you can "log in" with the Try it out form. What it does is add a header ( or query ) of your choosing to each request. Unfortunately, ( and this is the "not ideal" part). You'll have to make this a two part process.&nbsp;&gt; For the `securityDefinitions` and `security` in your schema... exmple:&nbsp;https://swaggerhub.com/api/ponelat/with-cookies/1/edit and reference:&nbsp;https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#securityDefinitionsObject&nbsp;Once you've set it up..1. Get your cookie string by calling your endpoint, then looking at the Response Headers for&nbsp;"set-cookie"2. Authenticate your session by clicking on the "Authorize button"&nbsp;2.1 Then you can paste your cookie string. And subsequent requests ( that have the security property ) will include the Cookie header.&nbsp;&nbsp;Happy Developing!&nbsp;Josh

Forum Discussion

Can I use my existing session cookie authentication for my API when testing on swaggerhub?

Related Content

Two potential naming issues with api key authentication within SwaggerHub UI

Kafka topic using OAuth2 authentication

Check if object exists

SwaggerHub Unavailable

dotNET.System_IO doesn't exist anymore?

Recent Discussions

3.1.0 Editor exports inlined?

Error exporting Standardization rules

Import API using API endpoint with Authorization

Having issue with 'should NOT have additional properties additionalProperty: responses'

Error 400 - Bad Request