If I Use the Name "Authorization" when I add Header, it doesn't send the Header

[morguee]

If I Use the Name "authorization" when I add Header in Parameters, it doesn't send the Header, but if I use any other word besides "authorization", it sends the header. Here's an example of what I did.

parameters => [

{name => <<"authorization">>,

                   description => <<"Auth Header">>,
                   in => <<"header">>,
                   required => true,
                   schema => #{type => string}}],

Also I know there's a way to add a security feature where you can add an auth_key in the swagger ui, but when I follow the specs I can't seem to get it to work. What are the best practices for adding an auth key using this Erlang wrapper? If anyone has an example of doing so, it would help me a lot, thanks.

[paulo-ferraz-oliveira]

Hi, @morguee.

cowboy_swagger itself does nothing in regards to the Authorization header (we only import a given Swagger UI version). This might be Swagger -specific, though.

On the other hand, Swagger UI is supposed to handle the Authorization header for you, via configuration. You might find more information https://swagger.io/specification/ (I believe it states the Authorization header, as well as others, cannot be used as a parameter).

What are the best practices for adding an auth key using this Erlang wrapper?

Using cowboy_swagger for this should be no different from doing Swagger directly. The Security scheme object is defined at https://swagger.io/specification/?sbsearch=authorization#security-scheme-object.

[paulo-ferraz-oliveira]

The last time I used a bearer -based auth. I did it like so

    {cowboy_swagger, [
        {global_spec, #{
            securityDefinitions => #{
                bearer => #{
                    type => <<"apiKey">>,
                    name => <<"x-api-key">>,
                    in => <<"header">>
                }
            },
...

but it's possible this has changed. What this did was show a Swagger UI where you could write a token and it would persist (being send with every request) until the page was refreshed.