10

Swagger UI refuses to make a request to https with self signed certificate.

The problem is next:

curl -X POST "https://localhost:8088/Authenticate" -H "accept: pplication/json" -H "Content-Type: application/json" -d "{ \"username\":"user\", \"password\": \"user\"}"

Above command is generated by swagger automatically and after run it returns :

TypeError: Failed to fetch

Manually (not using Swagger UI) run returns :

curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.


I want to make it like next (add --insecure parameter):

curl -X POST "https://localhost:8088/Authenticate" -H "accept: application/json" -H "Content-Type: application/json" -d "{ \"username\": \"user\", \"password\": \"user\"}" --insecure

This will allow me to perform a desired request. Is there a way to add custom parameters to autogenerated Swagger curl? Thanks.

Vladyslav Nikolaiev
  • 1,819
  • 3
  • 20
  • 39

3 Answers3

9

Firstly, the cURL command is for display and copy-pasting only. Swagger UI does not actually use cURL for requests – it's a web page so it makes requests using JavaScript (fetch API or XMLHttpRequest or similar).

As explained here, Swagger UI does not support self-signed certificates (emphasis mine):

It appears you have a problem with your certificate. There's no way for Swagger-UI (or any in-browser application) to bypass the certificate verification process built into the browser, for security reasons that are out of our control.

It looks like you have a self-signed certificate. You'll want to look into how to get your computer to trust your certificate, here's a guide for Google Chrome, which it looks like you're using:

Getting Chrome to accept self-signed localhost certificate

So if you want to use Swagger UI to test a server that uses a self-signed certificate, you'll need to configure your browser (or your computer) to trust that certificate. Check out these questions for suggestions:

Chrome: Getting Chrome to accept self-signed localhost certificate
Firefox: Is there a way to make Firefox ignore invalid ssl-certificates?


Is there a way to add custom parameters to autogenerated Swagger curl?

The code to generate the cURL command lives here:
https://github.com/swagger-api/swagger-ui/blob/master/src/core/curlify.js

You can fork Swagger UI and tweak the code as your needs dictate.

But as explained above – changing the displayed cURL command won't change the actual "try it out" behavior, because "try it out" cannot bypass certificate validation.

Community
  • 1
  • 1
Helen
  • 87,344
  • 17
  • 243
  • 314
2

The real problem was that my OPTIONS response headers did not match my future POST request headers, since I had to use CORS.

Vladyslav Nikolaiev
  • 1,819
  • 3
  • 20
  • 39
0

I've checked this post because I am searching how would be the easiest/intelligent way to make a test request in an API. As far as this post is concerned it seems to me that Swagger.io is not using the fetch API or XMLHttpRequest.

I've checked the code on: https://github.com/swagger-api/swagger-ui/blob/765056d1e4d28125f0dc4445ed9882531c3369ac/src/core/plugins/request-snippets/fn.js#L76

I could see it uses the CMD line cURL.exe. So, I would like to ask you further... Which way would be the best for an API Tester of Webservices? Since it would need to make undefinable requests, would fetch API get it or we should just keep doing the "basic"?

PS: I also would like to add that "nc" would be a good alternative, though. Thanks for any comments on this subject in advance.

Gustavo Damasceno
  • 1