Swagger，JWT，身份验证后如何在调用中使用 token

Question

我是 Swagger 的新手。
我们已经编写了一个 API，所以我正在尝试手动编写 swagger.yaml

到目前为止，我已经弄清楚如何执行我的/login 路由……并在响应中返回 JWT。
但我不确定接下来要走什么路。
是否可以将返回的 JWT 自动插入后续调用中？
还是我必须手动复制并粘贴返回的 JWT？

如果我必须手动执行它.. 那么.. ehh.. 怎么做？
在 swagger 编辑器中会出现一个 Authenticate 按钮，我可以点击它并获得一个输入框，寻找 apikey ...
但是在查看 swagger UI 时它不一样......当我浏览到 localhost 以查看 swagger UI 时，我没有获得身份验证按钮并且没有任何地方可以粘贴 JWT 文本......

我的 swagger.yaml 如下:

swagger: "2.0"
info:
  version: 1.0.0
  title: Identity Management Service
  description: API to allow JWT authentication and authorisation
  termsOfService: http://swagger.io/terms/
  
  license:
    name: MIT
    url: http://github.com/gruntjs/grunt/blob/master/LICENSE-MIT
host: localhost:8000
basePath: /
schemes:
  - http
  - https
securityDefinitions:
  Bearer:
    type: apiKey
    name: Authorization
    in: header
consumes:
  - application/json
produces:
  - application/json
paths:
  /login:
    post:
      summary: User Authentication returning a JWT.
      description: Authenticate a user.
      parameters:
        - name: credentials
          in: body
          description: maximum number of results to return
          required: false
          schema:
            $ref: '#/definitions/creds'
      responses:
        "200":
          description: will send JWT
        default:
          description: unexpected error
          schema:
            $ref: '#/definitions/Error'
  /getUsers:
    get:
      summary: Gets list of all users
      description: Authenticate a user.
      security:
        - Bearer: []
      responses:
        "200":
          description: will send JWT
        default:
          description: unexpected error
          schema:
            $ref: '#/definitions/Error'
definitions:
  creds:
    type: object
    required:
      - username
      - password
    properties:
      username:
        type: string
      password:
        type: string

  Error:
    required:
      - code
      - message
    properties:
      code:
        type: integer
        format: int32
      message:
        type: string

显然，我更喜欢拥有它，以便将来自/login 调用的响应 token 存储并在/getUsers ...

调用/login 的响应如下所示:

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0eXBlIjoidXNlciIsInVzZXJpZCI6InBqbWVhbHkiLCJlbWFpbCI6InBqbWVhbHlAZ21haWwuY29tIiwiZmlyc3RuYW1lIjoiUEoiLCJsYXN0bmFtZSI6Ik1lYWx5Iiwib3JnIjoib3JnMSIsInRlYW1zIjpbInRlYW0xIl0sImFjbCI6WyJlbXBsb3llZSIsInRlYW1MZWFkIl0sInRva2VuVHlwZSI6IndlYkFwcFRva2VuIiwidG9rZW5WZXJzaW9uIjoiMSIsImlhdCI6MTQ2NzkxMDkyNSwiZXhwIjoxNDY3OTk3MzI1fQ.e4Trk-0kDoid5Xr9BQ5ZP_HMBN2l8_G2pn7ac2tt4uE",
  "user": {
    "type": "user",
    "userid": "joebloggs",
    "email": "joe@bloggs.com",
    "firstname": "Joe",
    "lastname": "Bloggs",
    "org": "org1",
    "teams": [
      "team1"
    ],
    "acl": [
      "employee",
      "teamLead"
    ],
    "tokenType": "webAppToken",
    "tokenVersion": "1",
    "iat": 1467910925,
    "exp": 1467997325
  }
}

Answer 1

你可以试试这个，它包含一个授权头，你可以在其中保存 token ，它将应用于所有端点。

@Bean
public Docket newsApi() {
    return new Docket(DocumentationType.SWAGGER_2)
            .select()
            .apis(RequestHandlerSelectors.any())
            .paths(PathSelectors.any())
            .build()
            .securitySchemes(Lists.newArrayList(apiKey()))
            .securityContexts(Lists.newArrayList(securityContext()))
            .apiInfo(generateApiInfo());
}

@Bean
SecurityContext securityContext() {
    return SecurityContext.builder()
            .securityReferences(defaultAuth())
            .forPaths(PathSelectors.any())
            .build();
}

List<SecurityReference> defaultAuth() {
    AuthorizationScope authorizationScope
            = new AuthorizationScope("global", "accessEverything");
    AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
    authorizationScopes[0] = authorizationScope;
    return Lists.newArrayList(
            new SecurityReference("JWT", authorizationScopes));
}

private ApiKey apiKey() {
    return new ApiKey("JWT", "Authorization", "header");
}