jenyayel/swaggersecuritytrimming

Demo for trimming visibility of endpoints in Swagger

swaggersecuritytrimming's Issues

Sample v3 not working and workaround

Hi @jenyayel, i'm using Swagger 6.1.1 and trying to use your sample code (src/v3) but i noted some issue in code:

swagger-custom.js:

in isAuthorized method i have to change:
const auth = getAuthorization(); return auth && !!auth[1].size
with
const auth = getAuthorization(); return auth && auth[1].size !== 0

in getBearer method i have to change:
const def = auth[1]._root.entries.find(e => e[0] === 'BearerDefinition');
with
const def = auth[1]._root.entries.find(e => e[0] === 'Bearer');

SecurityTrimming.cs:

in SecurityTrimming class i can read the authorization header but the property http.HttpContext.User.Identity.IsAuthenticated is always false, so as workaround i not check the HttpContext.User but i manually parse the accessToken from the authorization header to read the user claims using:

var isAuthenticated = false;
List<string> userRoles = null;
var authorizationHeader = http.HttpContext.Request.Headers["Authorization"].FirstOrDefault();
if (!string.IsNullOrEmpty(authorizationHeader) && authorizationHeader.StartsWith("Bearer "))
{
    var accessToken = authorizationHeader.Substring(7);
    var claims = ParseClaimsFromJwt(accessToken);
    if (claims != null)
    {
        isAuthenticated = true;
        var roleClaim = claims.FirstOrDefault(c => c.Type == ClaimTypes.Role);
        if (roleClaim != null)
            userRoles = roleClaim.Value.Split(new char[] { ',' }, System.StringSplitOptions.TrimEntries).ToList();
    }
}
...
...
public static IEnumerable<Claim> ParseClaimsFromJwt(string accessToken)
{
      var claims = new List<Claim>();
      var payload = accessToken.Split('.')[1];
      var jsonBytes = ParseTokenPayload(payload);
      var keyValuePairs = JsonSerializer.Deserialize<Dictionary<string, object>>(jsonBytes);
      return keyValuePairs.Select(kvp => new Claim(kvp.Key, kvp.Value.ToString()));
}

i don't know if this issue is related to my configuration, but i give you this workaround if you reply the problem.