README
¶
Vendored Swagger UI
assets/ holds three files from the swagger-ui-dist npm package, release
5.17.14 (Apache-2.0; LICENSE and NOTICE are kept beside them):
| file | sha256 |
|---|---|
swagger-ui-bundle.js |
c2e4a9ef08144839ff47c14202063ecfe4e59e70a4e7154a26bd50d880c88ba1 |
swagger-ui.css |
40170f0ee859d17f92131ba707329a88a070e4f66874d11365e9a77d232f6117 |
Only the bundle and the stylesheet are used; the package's index.html,
standalone preset and source maps are left out.
Updating
- In an empty directory outside the repository:
npm pack swagger-ui-dist@<version>(npm checks the tarball's integrity), then extract it. - Copy
swagger-ui-bundle.js,swagger-ui.css,LICENSEandNOTICEintoassets/. - Update
Versioninswaggerui.goand the table above (shasum -a 256). - Run
go test ./openapi/...and open/docs/in a browser against an app with a documented route. - Record the version in the changelog.
Under a Content-Security-Policy
WithContentSecurityPolicy serves the page under the application's policy with the three changes Swagger UI needs: style-src allows 'unsafe-inline', img-src allows data:, and connect-src allows 'self'. The changes apply to the UI page's route only. See the content security policy guide.
Documentation
¶
Overview ¶
Package swaggerui serves Swagger UI, embedded in the binary, for the openapi package:
openapi.New(openapi.Options{UI: swaggerui.New()})
Importing it adds about 1.5 MB to the binary, which is why it is a package of its own: an app that only wants the document does not import it. Nothing is fetched from the network, so the page works offline. Under a strict Content-Security-Policy the page needs three relaxations: 'unsafe-inline' in style-src, data: in img-src, and 'self' in connect-src so it can fetch the document. WithContentSecurityPolicy grants them on the page's route only.
Index ¶
Constants ¶
const Version = "5.17.14"
Version is the swagger-ui-dist release the assets come from.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶ added in v0.8.0
type Option func(*UI)
Option configures New.
func WithContentSecurityPolicy ¶ added in v0.8.0
WithContentSecurityPolicy serves the UI page under app with three changes: style-src is 'self' and 'unsafe-inline', because Swagger UI writes inline styles at runtime; img-src is app's effective img-src with data: added, because its styles reference data: images; and connect-src is app's effective connect-src with 'self' added, so the page can fetch its own document. An absent directive falls back to default-src, and a directive that restricts nothing is left unrestricted. Every other directive of app is kept, so the relaxation is confined to the page's route. The middleware sets the page's header in place of the application's. The document, the assets and the rest of the application keep app's policy.
Source Files