restrict swagger Ui access on IIS 10.

there is no direct configuration on IIS, however, there are multiple solutions, like creating Http Module, Http Handler etc.

here is HttpMessageHandler that you can use

public class RestrictSwaggerHandler: DelegatingHandler
{
protected override Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
if (IsSwagger(request) && !Thread.CurrentPrincipal.Identity.IsAuthenticated)
{
var response = request.CreateResponse(HttpStatusCode.Unauthorized);
return Task.FromResult(response);
}
else
{
return base.SendAsync(request, cancellationToken);
}
}
private bool IsSwagger(HttpRequestMessage request)
{
return request.RequestUri.PathAndQuery.StartsWith("/swagger");
}
}

Now Add this Handler to the SwaggerConfig, open SwaggerConfig.cs, and copy-paste the below line of code.

1 Reply

Know the answer? Post it — somebody with the same question will find it here.