Swagger API Documentation Exposure: Hiding Internal Endpoints

Swagger UI and OpenAPI interactive docs (/swagger-ui/, /api-docs) provide developers with human-readable visualizations of web service APIs, detailing routes, expected inputs, and response formats.

On production systems, publicly accessible Swagger interfaces supply attackers with an exhaustive roadmap for vulnerability discovery, highlighting internal endpoints, administrative methods, and input schemas.

Vulnerability Risk & Threat Impact

Public API documentation removes the need for attacker reconnaissance, providing immediate visibility into undocumented parameters, legacy routes, and database entities.

How Our Scanner Inspects for This Flaw

Site Check probes common interactive API documentation paths (/swagger-ui, /swagger.json, /api/docs) to determine if they are exposed without authentication.

Inspection of administrative interfaces and dashboards probes common telemetry endpoints. The scanner reviews HTTP authentication response headers (WWW-Authenticate), login page redirects, and document headers without executing credential brute-force or unauthorized session creation.

Remediation Guide (Step-by-Step Fix)

To resolve this vulnerability, apply the following configuration or code snippet to your web server:

      # Protect Swagger UI with HTTP Basic Authentication in production:
location /swagger-ui/ {
    auth_basic "Restricted Internal API Docs";
    auth_basic_user_file /etc/nginx/.htpasswd;
}
    

• Disable automated Swagger UI generation in production runtime environments.
• If external documentation is required, restrict access behind corporate authentication or VPN gateways.

Attack Anatomy & Real-World Business Impact

Public Swagger UI and OpenAPI specifications document all internal endpoints, schemas, and parameter validations, providing threat actors with a complete attack blueprint to test for BOLA and injection flaws.

Compliance Framework Impact: Violation of fundamental security controls specified in OWASP Top 10 (A05:2021 Security Misconfiguration), SOC 2 Type II trust criteria, and ISO 27001 Annex A.

CLI Remediation Verification: Terminal Commands

After applying configuration changes or patching source code, verify that the exposure is neutralized using command-line diagnostic tools:

curl -I -s https://your-domain.com/swagger-ui/ | grep "HTTP/"
# Expected: 404 or 401
    

DevSecOps Best Practices & CI/CD Hardening

Disable Swagger UI in production builds (NODE_ENV=production) or restrict API documentation to private internal subdomains.