Communities

Writing
Writing
Codidact Meta
Codidact Meta
The Great Outdoors
The Great Outdoors
Photography & Video
Photography & Video
Scientific Speculation
Scientific Speculation
Cooking
Cooking
Electrical Engineering
Electrical Engineering
Judaism
Judaism
Languages & Linguistics
Languages & Linguistics
Software Development
Software Development
Mathematics
Mathematics
Christianity
Christianity
Code Golf
Code Golf
Music
Music
Physics
Physics
Linux Systems
Linux Systems
Power Users
Power Users
Tabletop RPGs
Tabletop RPGs
Community Proposals
Community Proposals
tag:snake search within a tag
answers:0 unanswered questions
user:xxxx search by author id
score:0.5 posts with 0.5+ score
"snake oil" exact phrase
votes:4 posts with 4+ votes
created:<1w created < 1 week ago
post_type:xxxx type of post
Search help
Notifications
Mark all as read See all your notifications »
Q&A

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Post History

77%
+5 −0
Q&A Best practices for company internal Swagger Docs in production

The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID). To simplify the development, all services expose ...

1 answer  ·  posted 11mo ago by Alexei‭  ·  edited 10mo ago by Alexei‭

#4: Nominated for promotion by user avatar Alexei‭ · 2024-01-28T12:53:23Z (10 months ago)
#3: Post edited by user avatar Alexei‭ · 2024-01-14T13:15:11Z (10 months ago)
fixed the title
  • Best practices for company internal Swagger UI in production
  • Best practices for company internal Swagger Docs in production
#2: Post edited by user avatar Alexei‭ · 2024-01-13T08:04:08Z (10 months ago)
keeping only the risks I understand
  • The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID).
  • To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production.
  • I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, injection vulnerabilities, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs:
  • - access is limited to internal users
  • - non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint
  • Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?
  • The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID).
  • To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production.
  • I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs:
  • - access is limited to internal users
  • - non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint
  • Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?
#1: Initial revision by user avatar Alexei‭ · 2024-01-05T18:30:05Z (11 months ago)
Best practices for company internal Swagger UI in production
The current project I am working on consists of a bunch of microservices (Web APIs) accessible only internally using Entra ID (formerly Azure ID).

To simplify the development, all services expose Swagger Docs, but our SRE told us that Swagger Docs should be disabled in production.

I understand [the risks of publicly exposing Swagger Docs in production](https://stackoverflow.com/a/76654683/2780791) (increased attack surface, information exposure, injection vulnerabilities, unauthorized access risks), but I think none of these apply to the case of having an internal Swagger Docs:

- access is limited to internal users
- non-prod Swagger Docs is accessible. That means that even with Prod Swagger Docs disabled, anyone with prod access can use a bearer token and Postman (or similar) to call an accessible endpoint

Does disabling Swagger Docs for the production environment make sense when all endpoints are accessible internally only?