Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Post History
The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID). To simplify the development, all services expose ...
#4: Nominated for promotion
by
Alexei
·
2024-01-28T12:53:23Z (4 months ago)
#3: Post edited
by
Alexei
·
2024-01-14T13:15:11Z (4 months ago)
fixed the title
Best practices for company internal Swagger UI in production
- Best practices for company internal Swagger Docs in production
#2: Post edited
by
Alexei
·
2024-01-13T08:04:08Z (4 months ago)
keeping only the risks I understand
- The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID).
- To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production.
I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, injection vulnerabilities, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs:- - access is limited to internal users
- - non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint
- Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?
- The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID).
- To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production.
- I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs:
- - access is limited to internal users
- - non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint
- Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?
#1: Initial revision
by
Alexei
·
2024-01-05T18:30:05Z (4 months ago)
Best practices for company internal Swagger UI in production
The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID). To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production. I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, injection vulnerabilities, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs: - access is limited to internal users - non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?