ASP.NET Core Web API Interview Question #93

How should authentication be documented in OpenAPI?

Routing, Versioning, OpenAPI/Swagger & API Documentation Mid-Level Intermediate

Quick Interview Answer

The OpenAPI document can define a security scheme such as HTTP bearer authentication and apply security requirements to protected operations. Interactive documentation tools can then allow a developer to supply a token when testing authorized endpoints.

Detailed Explanation

The OpenAPI document can define a security scheme such as HTTP bearer authentication and apply security requirements to protected operations. Interactive documentation tools can then allow a developer to supply a token when testing authorized endpoints.

Documentation does not enforce security; the ASP.NET Core authentication and authorization configuration remains responsible for protecting the endpoint.

Code Example

// Conceptual Swagger configuration:
options.AddSecurityDefinition("Bearer",
    new OpenApiSecurityScheme
    {
        Type = SecuritySchemeType.Http,
        Scheme = "bearer",
        BearerFormat = "JWT"
    });