Skip to content

feat: Add login endpoint configuration with example values for username and password - #3323

Open
Mattias-Sehlstedt wants to merge 2 commits into
springdoc:mainfrom
Mattias-Sehlstedt:configure-spring-login-example
Open

feat: Add login endpoint configuration with example values for username and password#3323
Mattias-Sehlstedt wants to merge 2 commits into
springdoc:mainfrom
Mattias-Sehlstedt:configure-spring-login-example

Conversation

@Mattias-Sehlstedt

Copy link
Copy Markdown
Contributor

Adds two new configuration properties that let users define example values for the username and password fields of the auto-generated Spring Security login endpoint, so those examples show up in the OpenAPI document and Swagger UI "Try it out" form.

New configuration properties

Property Description
springdoc.login-endpoint.username-example Example value applied to the username field of the login request body.
springdoc.login-endpoint.password-example Example value applied to the password field of the login request body.

Example:

springdoc.show-login-endpoint=true
springdoc.login-endpoint.username-example=demouser
springdoc.login-endpoint.password-example=secret

The new app13 tests are copied from the existing app6 tests to showcase the the previous behavior with springdoc.show-login-endpoint=true is not affected.

Fixes: #3321

An alternative design would be a single boolean flag (e.g. springdoc.login-endpoint.show-credentials=true) that reads the application's actual configured username/password (such as spring.security.user.name / spring.security.user.password) and injects them as examples. That was deliberately not chosen, as a separation of concerns as well as a safety measure.

Documentation examples are a documentation concern; they should not be coupled to, or reach into, security configuration internals. Such a solution could easily result in the user setting the property to true in the root application.properties, and it thus affecting the prod settings too. This solution forces the user to specify the exact credentials, which could only do harm if the user has the same credentials in test and prod.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support adding example values to the Spring Security login endpoint.

1 participant