Swagger ошибка 403

user1007522user1007522

7,87817 gold badges69 silver badges113 bronze badges

Try adding the following resources in the ignored list,

• /swagger-resources/**
• /webjars/**

Here is the complete example,

@Override
public void configure(WebSecurity web) throws Exception {    
    web.ignoring().antMatchers("/v2/api-docs/**");
    web.ignoring().antMatchers("/swagger.json");
    web.ignoring().antMatchers("/swagger-ui.html");
    web.ignoring().antMatchers("/swagger-resources/**");
    web.ignoring().antMatchers("/webjars/**");
}

answered Feb 1, 2018 at 19:01

You have to explicit ignore all your required static resources for swagger in your Spring Security Configuration. The error message you get from the network tab indicates that the browser is able to load the swagger-ui.html file but is unable to load the related .js/.css/images/iconsbecause they are not ignored in your Security Configuration.

Try this solution:

@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources", "/configuration/security", "/swagger-ui.html", "/webjars/**");
    }

}

Related stackoverflow post: How to configure Spring Security to allow Swagger URL to be accessed without authentication

answered Feb 1, 2018 at 18:59

joeabalajoeabala

2663 silver badges11 bronze badges

HTTP Error 403.14 - Forbidden
The Web server is configured to not list the contents of this directory.

Perhaps the Swagger routes aren’t getting registered with your WebAPI. I’ve seen this happen with certain deployment setups due to the use of WebActivatorEx. You can bypass this and register manually by removing the following line in SwaggerConfig.cs:

[assembly: PreApplicationStartMethod(typeof(SwaggerConfig), "Register")]

And then invoking the Register method directly in your global.asax:

protected void Application_Start()
{
    SwaggerConfig.Register();            
    GlobalConfiguration.Configure(WebApiConfig.Register);
}

Give it a try and let me know if this helps?

I have the same Issue, started on ASP.NET Core 1.0 and everything worked fine. Because of a .NET 2 dependency we needed to step back to ASP.NET MVC 5.0 and now I run into this error. The suggestion to place this in the Application_Start or in my case OwinStartup didn’t fix the 403.14 error.

Swagger is loaded, when I type in …/swagger it redirect to …/swagger/ui/index and it shows the 403.14 error. If I type in …/docs/v1 it shows: {«swagger»:»2.0″,»info»:{«version»:»v1″,»title»:»My Title»},»host»:»localhost:3897″,»schemes»:[«http»],»paths»:{},»definitions»:{}}

Oke… really strange, I played a bit with switching hosted environments, from IIS Express to Local IIS and even self-hosted OWIN in a cmd prompt. Now back to IIS Express (another port!) and it suddenly works… I have no clue why it didn’t work before as it’s the same code…

Are you happy to close this issue?

Perhaps the topic starter ‘cknightdevelopment’ will never answer back. I hope my comments help someone in the future. Just close it as issue

I have a similar issue… except that the 403.14 error occurs when I try using just /swagger. If I type the full path /swagger/ui/index it resolves. Any ideas?

I have the same issue right now. None of the workarounds have worked. I do not get redirected to ui/index, just get the forbidden message.

Any help is greatly appreciated.

You can always specify the startup url and things should work properly.

just for sharing: for the HTTP Error 403.14 — Forbidden, either of these works for me:

1. change project url to another port(Project Properties -> Web -> Project Url)
2. specify a base url for EnableSwaggerUi(«docs/{*assetPath}»)

but still not know the reason of 403 error

Sharing this fix as well for «HTTP Error 403.14 — Forbidden» that worked for me:

Delete the .vs folder that contains the applicationhost.config file and restart Visual Studio before trying to use Swagger again.

Another reason that this happens;

Developing locally with IIS / IIS Express and SSL, all works. When publishing to Azure (or probably anywhere else) you get a 403 Forbidden when trying to request a JWT token (or access the anonymous login endpoint).

Took me a while to find the answer, but publishing to Azure created a HTTPS capable website, unfortunately it launched the HTTP version in my browser which fails with 403 FORBIDDEN, even though the UI came up at /swagger.

Quick answer, make sure you are using HTTPS on your dev, test and live site urls.

If someone has this problem of «403.14 — Forbidden» when using «/swagger», but the use of the full path «/swagger/ui/index» works.
In my case, after having spent too much time looking for a solution and none worked, in the end the problem was simpler that I thought, I had a folder called swagger in the solution, when I changed the name to something else the problem was solved.
I hope this can prevent someone’s headaches

I am also having the same issue

And none of the solutions above worked on my side.

Are there latest approach that could help fix it?