In this demo, we will add support for authenticated APIs.
We learned on the slides that we need a security definition for that.
When calling into AddSwaggerGen,
we can define it by calling into AddSecurityDefinition.
What we pass through matches what we learn on the slides.
Let me import the necessary namespace, Microsoft.OpenApi.Models.
So, we call into AddSecurityDefinition.
We first pass through a name for that definition.
This is something we can choose, say, basicAuth.
The second parameter is an object of type OpenApiSecurityScheme.
We could use new syntax like this,
but to make this a bit more clear for demo purposes,
I'm just going to leave it at the full name.
For basic authentication, we have to pass through the Type,
SecuritySchemeType.Http, and the Scheme,
which is basic.
Note that this is case sensitive, so make sure you write basic in lowercase.
We also pass through a Description.
Let's give this a try, and let's have a look at the generated specification,
and let's scroll down.
Down here, we indeed see the new security scheme, as expected.
If we look at our UI, we see there's an Authorize button here.
Let's click that.
Here we can input our username and password.
Let's give that a try, and let's click Authorize.
This seems to be okay.
Now let's try getting our authors.
And we get back a 401 Unauthorized.
That's not good.
Moreover, it's an undocumented status code.
For the sake of completion,
we'll want to globally add that one as a valid status code as well.
So let's fix these two things, and let's start with what we already know.
We'll add a new ProducersResponseTypeAttribute globally,
so through the Filters collection.
Like that, we state that this is a possible valid known response.
Let's scroll down again.
This is where we add the SecurityDefinition.
Even though we provided our username and password,
that username and password isn't automatically sent as an
authorization header for each request.
To ensure it is,
we must mark the operation in the OpenAPI Spec as
one that requires authentication.
To that avail, we call in to AddSecurityRequirement.
This expects an OpenApiSecurityRequirement object,
and that is in fact a dictionary with an OpenApiSecurityScheme scheme.
We want to add one.
What is special about this is that we actually want to reference the
OpenApiSecurityScheme we used when we added a SecurityDefinition.
We can do that by passing through a Reference object
that's of type OpenApiReference.
So we reference a SecurityScheme with Id basicAuth,
which matches the name we gave when we called into AddSecurityDefinition.
The value of the dictionary item is a List.
This is used when working with tokens and scopes.
We don't have that for basicAuth,
so in our case we just pass through an empty List.
Let's give that a try.
Let's have a look at the OpenAPI specification.
Let's scroll all the way down, and we indeed see a security reference here.
Now let's have a look at the UI.
We now see a lock appear next to all operations.
We can either click the Authorize button here or click one of these
locks to pass through our authentication info,
so Pluralsight and Pluralsight.
And let's give this a try by getting a list of authors.
There we go, this time we do get back our authors. Let's have a look at the module summary.