ASP.NET Core Web API Interview Question #97
Should Swagger UI be enabled in production?
Routing, Versioning, OpenAPI/Swagger & API Documentation Mid-Level Intermediate
Quick Interview Answer
It depends on the API's exposure model and organizational requirements. Public APIs may intentionally publish interactive documentation, while private or security-sensitive systems may disable it, restrict it to authenticated users, or expose documentation through a separate developer portal.
Detailed Explanation
It depends on the API's exposure model and organizational requirements. Public APIs may intentionally publish interactive documentation, while private or security-sensitive systems may disable it, restrict it to authenticated users, or expose documentation through a separate developer portal.
Disabling Swagger UI does not secure the API itself. Authentication, authorization, network controls, validation, and other security measures must protect the actual endpoints.
Code Example
if (app.Environment.IsDevelopment())
{
app.UseSwagger();
app.UseSwaggerUI();
}
// Production policy should be an explicit decision.