/api/swagger is public visible if REQUIRE_SIGNIN_VIEW is true #7553

New Issue

GiteaMirror · 2025-11-02T07:29:39-06:00

GiteaMirror commented

2025-11-02 07:29:39 -06:00

Originally created by @r10r on GitHub (Jul 7, 2021).

Gitea version (or commit ref):1.14.2

Hi there,

I'm a new, and very impressed, gitea user.

I've installed gitea for internal and external use and want to show the swagger ui '/api/swagger'
only for authenticated users.

I did set REQUIRE_SIGNIN_VIEW: true. The Explore now shows the sign-in view but the swagger view is still visible for unauthenticated users.

REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page or to use API.

Is that intended behaviour or a bug ?

Regards,
Ruben

Originally created by @r10r on GitHub (Jul 7, 2021). - Gitea version (or commit ref):1.14.2 Hi there, I'm a new, and very impressed, gitea user. I've installed gitea for internal and external use and want to show the swagger ui '/api/swagger' only for authenticated users. I did set `REQUIRE_SIGNIN_VIEW: true`. The `Explore` now shows the sign-in view but the swagger view is still visible for unauthenticated users. > REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page or to use API. Is that intended behaviour or a bug ? Regards, Ruben

GiteaMirror added the type/docs label 2025-11-02 07:29:39 -06:00

GiteaMirror closed this issue

2025-11-02 07:29:39 -06:00

GiteaMirror commented

2025-11-02 07:29:40 -06:00

@lunny commented on GitHub (Jul 8, 2021):

I think that's by designer. i.e. Even Github enterprise's API docs are also open.

@lunny commented on GitHub (Jul 8, 2021): I think that's by designer. i.e. Even Github enterprise's API docs are also open.

GiteaMirror commented

2025-11-02 07:29:40 -06:00

@r10r commented on GitHub (Jul 8, 2021):

Ok, then maybe the documentation for REQUIRE_SIGNIN_VIEW should be changed from

REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page or to use API.

into something like

REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page except the API pages.

@r10r commented on GitHub (Jul 8, 2021): Ok, then maybe the documentation for `REQUIRE_SIGNIN_VIEW` should be changed from > REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page or to use API. into something like >REQUIRE_SIGNIN_VIEW: false: Enable this to force users to log in to view any page except the API pages.

GiteaMirror commented

2025-11-02 07:29:40 -06:00

@techknowlogick commented on GitHub (Jul 8, 2021):

The API is still blocked from being accessed, it's only the swagger documentation that is available.

@techknowlogick commented on GitHub (Jul 8, 2021): The API is still blocked from being accessed, it's only the swagger documentation that is available.

GiteaMirror commented

2025-11-02 07:29:40 -06:00

@r10r commented on GitHub (Jul 8, 2021):

Ok I see. For a new user like me the wording view any page may include the swagger API pages, but since swagger can be disabled separately I simply got it wrong. Thanks for clarification!

The API is still blocked from being accessed.

Does that mean that there are API calls that can be made without an access token otherwise ?

@r10r commented on GitHub (Jul 8, 2021): Ok I see. For a new user like me the wording `view any page` may include the swagger API pages, but since swagger can be disabled separately I simply got it wrong. Thanks for clarification! > The API is still blocked from being accessed. Does that mean that there are API calls that can be made without an access token otherwise ?

GiteaMirror commented

2025-11-02 07:29:40 -06:00

@techknowlogick commented on GitHub (Jul 8, 2021):

Does that mean that there are API calls that can be made without an access token otherwise ?

API would need access token. For example going to example.com/api/v1/version would return an error saying auth is needed.

@techknowlogick commented on GitHub (Jul 8, 2021): > Does that mean that there are API calls that can be made without an access token otherwise ? API would need access token. For example going to example.com/api/v1/version would return an error saying auth is needed.

GiteaMirror commented

2025-11-02 07:29:41 -06:00

@KN4CK3R commented on GitHub (Jul 9, 2021):

That's not correct. Most read-apis do not require auth. Your example for example: https://try.gitea.io/api/v1/version

@KN4CK3R commented on GitHub (Jul 9, 2021): That's not correct. Most read-apis do not require auth. Your example for example: https://try.gitea.io/api/v1/version

GiteaMirror commented

2025-11-02 07:29:41 -06:00

@techknowlogick commented on GitHub (Jul 9, 2021):

@KN4CK3R specifically if the REQUIRE_SIGNIN_VIEW is set to true, then those endpoints won't be accessible.

edit: just confirmed using by private instance and this is what I see when logged out for the version api

@techknowlogick commented on GitHub (Jul 9, 2021): @KN4CK3R specifically if the `REQUIRE_SIGNIN_VIEW` is set to true, then those endpoints won't be accessible. edit: just confirmed using by private instance and this is what I see when logged out for the version api ![Screen Shot 2021-07-09 at 1 26 36 PM](https://user-images.githubusercontent.com/164197/125115448-55eb7d00-e0b9-11eb-8f93-dd7cd47dca8c.png)

GiteaMirror commented

2025-11-02 07:29:41 -06:00

@KN4CK3R commented on GitHub (Jul 9, 2021):

Ah, I thought you talked about general access.

@KN4CK3R commented on GitHub (Jul 9, 2021): Ah, I thought you talked about general access.

GiteaMirror commented

2025-11-02 07:29:41 -06:00

@r10r commented on GitHub (Jul 13, 2021):

What about adding another config option to disable the swagger UI for non-authorized users ? E.g :

api. SWAGGER_REQUIRE_SIGNIN_VIEW

@r10r commented on GitHub (Jul 13, 2021): What about adding another config option to disable the swagger UI for non-authorized users ? E.g : `api. SWAGGER_REQUIRE_SIGNIN_VIEW`

GiteaMirror commented

2025-11-02 07:29:41 -06:00

@wxiaoguang commented on GitHub (Apr 26, 2023):

If you don't need it , you can set ENABLE_SWAGGER=false

@wxiaoguang commented on GitHub (Apr 26, 2023): If you don't need it , you can set `ENABLE_SWAGGER=false`

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7553