starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

using the Swagger-UI adds an additional "/api" to the request URL and is missing auth type in header #7969

New Issue
Closed
opened 2025-12-29 20:30:37 +01:00 by adam · 3 comments
adam commented 2025-12-29 20:30:37 +01:00
Owner
Copy Link

Originally created by @zeddD1abl0 on GitHub (May 1, 2023).

Originally assigned to: @arthanson, @jeremystretch on GitHub.

NetBox version

v3.5.0

Python version

3.9

Steps to Reproduce

  1. Go to the Swagger UI for the API (https:///api/schema/swagger-ui/)
  2. Authorize using token to activate testing with Swagger UI
  3. On any resource, attempt to use the Swagger UI

Expected Behavior

Swagger should be able to perform the action as expected by the API request used. It should be able to display the response from the request made.

Observed Behavior

The URL for the request that Swagger generates has another "/api" in the path. Also, the "Authentication" header is missing the "Token " preceding the token string itself.

For Example:

image

curl -X 'GET' \
  'https://netbox/api/api/dcim/devices/?id=1' \
  -H 'accept: application/json' \
  -H 'Authorization: <token>'

Results in the default "Page not Found" error page

image

The following does work

curl -X 'GET' \
  'https://netbox/api/dcim/devices/?id=1' \
  -H 'accept: application/json' \
  -H 'Authorization: Token <token>'
Originally created by @zeddD1abl0 on GitHub (May 1, 2023). Originally assigned to: @arthanson, @jeremystretch on GitHub. ### NetBox version v3.5.0 ### Python version 3.9 ### Steps to Reproduce 1. Go to the Swagger UI for the API (https://<yournetboxurl>/api/schema/swagger-ui/) 2. Authorize using token to activate testing with Swagger UI 3. On any resource, attempt to use the Swagger UI ### Expected Behavior Swagger should be able to perform the action as expected by the API request used. It should be able to display the response from the request made. ### Observed Behavior The URL for the request that Swagger generates has another "/api" in the path. Also, the "Authentication" header is missing the "Token " preceding the token string itself. For Example: ![image](https://user-images.githubusercontent.com/8335605/235457101-74e3c809-bbab-4066-bd8e-057cedf2c35d.png) ```bash curl -X 'GET' \ 'https://netbox/api/api/dcim/devices/?id=1' \ -H 'accept: application/json' \ -H 'Authorization: <token>' ``` Results in the default "Page not Found" error page ![image](https://user-images.githubusercontent.com/8335605/235455215-db8d1343-4fff-4bc2-ac9d-09288251e87f.png) The following does work ```bash curl -X 'GET' \ 'https://netbox/api/dcim/devices/?id=1' \ -H 'accept: application/json' \ -H 'Authorization: Token <token>' ```
adam added the type: bugstatus: acceptedtopic: OpenAPI labels 2025-12-29 20:30:37 +01:00
adam closed this issue 2025-12-29 20:30:37 +01:00
adam commented 2025-12-29 20:30:38 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 1, 2023):

I was able to correct the base path in the 12410-openapi-fixes branch, however I'll need to dig more into resolving the missing token prefix for the authorization header. The drf-spectacular documentation suggests using OpenApiAuthenticationExtension to override the header, however this is the default format employed by DRF so I'm surprised it doesn't work out of the box.

@jeremystretch commented on GitHub (May 1, 2023): I was able to correct the base path in the `12410-openapi-fixes` branch, however I'll need to dig more into resolving the missing token prefix for the authorization header. The `drf-spectacular` documentation suggests using [`OpenApiAuthenticationExtension`](https://drf-spectacular.readthedocs.io/en/latest/customization.html#specify-authentication-with-openapiauthenticationextension) to override the header, however this is the default format employed by DRF so I'm surprised it doesn't work out of the box.
adam commented 2025-12-29 20:30:38 +01:00
Author
Owner
Copy Link

@arthanson commented on GitHub (May 1, 2023):

"Token" needs to be added when you enter the authentication details in the api/schema Authorize dialog (see screenshot below) if you do enter "Token xxx..." it works correctly. Not sure why spectacular does it this way, seems like they should be able to auto-generate that, but it is by design in spectacular.

Monosnap NetBox REST API 2023-05-01 12-40-40

@arthanson commented on GitHub (May 1, 2023): "Token" needs to be added when you enter the authentication details in the api/schema Authorize dialog (see screenshot below) if you do enter "Token xxx..." it works correctly. Not sure why spectacular does it this way, seems like they should be able to auto-generate that, but it is by design in spectacular. ![Monosnap NetBox REST API 2023-05-01 12-40-40](https://user-images.githubusercontent.com/99642/235524743-47ac8f39-5cd8-40c4-96ed-b70cae06304b.png)
adam commented 2025-12-29 20:30:38 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 1, 2023):

Given that this isn't technically a bug, and that it's a separate issue from the base path problem, I'm going to close this as resolved by my work in the 12410-openapi-fixes branch. That said, I'm happy to entertain a separate FR with a proposal to improve the Swagger UI to make the authorization process more intuitive.

@jeremystretch commented on GitHub (May 1, 2023): Given that this isn't technically a bug, and that it's a separate issue from the base path problem, I'm going to close this as resolved by my work in the `12410-openapi-fixes` branch. That said, I'm happy to entertain a separate FR with a proposal to improve the Swagger UI to make the authorization process more intuitive.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted topic: OpenAPI type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#7969
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?