jensoleg / swagger-ui

Swagger UI is a dependency-free collection of HTML, Javascript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API.
http://swagger.io
Other
1.14k stars 310 forks source link

Unable to add custom header on Swagger AJAX request #40

Open nityanarayan44 opened 8 years ago

nityanarayan44 commented 8 years ago

Hello all,

I am trying to add 'Access-Control-Allow-Origin' in header. to do so i added this line... window.swaggerUi.api.clientAuthorizations.add("developer_key", apiKeyAuth); window.swaggerUi.api.clientAuthorizations.add("headerKey", new SwaggerClient.ApiKeyAuthorization('Allow-Access-Control-Origin', '*', "header"));

and then i run the appliation then i got an error:: XMLHttpRequest cannot load http://my_api_query. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

and i m getting this when i explore the request header :::>

Accept:*/* Accept-Encoding:gzip, deflate, sdch Accept-Language:en-US,en;q=0.8 Access-Control-Request-Headers:accept, developer_key, access-control-allow-origin Access-Control-Request-Method:GET Connection:keep-alive

there is no extra custom header added in the request header. it is adding my access-control-allow-origin as a value into Access-Control-Request-Headers.

i want to add this access-control-allow-origin as a new custom header like .:::>

Accept:*/* Accept-Encoding:gzip, deflate, sdch Accept-Language:en-US,en;q=0.8 Access-Control-Request-Headers:accept, developer_key Access-Control-Allow-Origin: * Access-Control-Request-Method:GET Connection:keep-alive

it also throws an error[::> Refused to set unsafe header "Origin"] when i directly add a line of code to swagger-ui.js [under //set header fields[Line: 22076 (may differ.)]]

xhr.setRequestHeader('Origin','http://somesitename.domain_ext');

can any one suggest me, what am i doing wrong, or what should i do extra to do this .....

mfrenzel commented 8 years ago

Same here, trying to add a Authorization Header fails (even in the sample index.html)