Request: Add ability to set security settings on the route

[fluky]

Title pretty much says it all. Currently you cannot set security settings, would be similar to the auth config.

[glennjones]

Hi sorry its taken me a while to get back to you, but its been a busy couple of weeks.

I believe what your looking for is already built in. Take a look at the bin/test-server.js file it is configured for one endpoint to use bearer token auth. This is supported both in Hapi and swaggerui. You should be able to see in the swaggerOptions setup the swagger Security Definitions Object

    securityDefinitions: {
        'Bearer': {
            'type': 'apiKey',
            'name': 'Authorization',
            'in': 'header'
        }
    },
    security: [{ 'Bearer': [] }]

In the bin/routes.js file you should be able to see use of auth property setting its use:

module.exports = [{
    method: 'PUT',
    path: '/v1/sum/add/{a}/{b}',
    config: {
        handler: defaultHandler,
        description: 'Add',
        tags: ['api', 'reduced'],
        notes: ['Adds together two numbers and return the result. As an option you can have the result return as a binary number.'],
        plugins: {
            'hapi-swagger': {
                consumes: ['application/json', 'application/xml']
            }
        },
        auth: 'bearer',
        validate: {
            params: {
                a: Joi.number()
                    .required()
                    .description('the first number'),

                b: Joi.number()
                    .required()
                    .description('the second number')
            }
        }

    }
}, 

_To try this out_

• Download the project from github In the command line cd to the directory
• $ npm install
• $ node bin\test-server
• In the browser go to http://localhost:3000

The first endpoint needs a the token to work, you can add it into the form input top right the value is Bearer 12345

If you wish can also set the Security Requirement Object by using the plugins property of a route. So if we take the swagger petstore example this security requirement reference would be set in a Hapi route

{
    'method': 'POST',
    'path': '/pets/
    'plugins': {
        'hapi-swagger': {
            'security': {
                'petstore_auth': [
                    'write: pets',
                    'read: pets'
                ]
            }
        }
    }
}

The above should allow you to define custom route based security setting in swagger.

Is this what your looking for?

[fluky]

Actually what I was trying to do was set the X-Frame-Options on the response to sameorigin so that I could display the API within an iFrame. I ended up switching to angular-swagger-ui to display without an iFrame.

[glennjones]

Something completely different what I thought. I am glad you found a solution with angular-swagger-ui.

Its unlikely I will be adding the ability to add headers to the routes add by the plugin options soon. The list of current options is getting so large I am waiting for a number of people to ask for feature before adding something that extends options list.

You could of cause server all the UI content through routes you create add the headers you want. There is a section in the readme about creating a custom page.

I will close this is issue, but if you have anymore problem along this line please add another comment and I will open it again.