Skip to content

Fix request-specific Swagger UI index transformations#3279

Open
limehee wants to merge 1 commit intospringdoc:spring-boot-4from
limehee:fix-swagger-index-nonce-cache
Open

Fix request-specific Swagger UI index transformations#3279
limehee wants to merge 1 commit intospringdoc:spring-boot-4from
limehee:fix-swagger-index-nonce-cache

Conversation

@limehee
Copy link
Copy Markdown
Contributor

@limehee limehee commented Apr 26, 2026

Fixes #3264

Summary

This PR makes swagger-ui/index.html use the uncached Swagger UI resource handler so request-specific SwaggerIndexTransformer changes are not reused across requests.

This keeps index.html aligned with swagger-initializer.js, which already uses an uncached handler.

Background

The regression appears to come from cc1a4e58c (Abstract shared Swagger configurer logic). That change introduced shared Swagger resource handler configuration and split Swagger UI resources into:

  • a cached handler for the general Swagger UI resource pattern
  • an uncached handler only for swagger-initializer.js

That works for static assets, but index.html is also passed through SwaggerIndexTransformer. If an application customizes the index page with request-specific data, such as a CSP nonce, the first transformed index.html response can be cached and reused for later requests.

For CSP, this is incorrect because the nonce must be generated per request.

Changes

  • Add Constants.INDEX_PAGE_PATTERN as /*index.html.
  • Register Swagger UI index.html patterns with the existing uncached resource handler path.
  • Keep the general Swagger UI resource handler cached.
  • Add a regression test that requests /swagger-ui/index.html twice with different request nonce values and verifies that the second response does not reuse the first nonce.

Verification

  • mvn -f springdoc-openapi-starter-common/pom.xml -DskipTests install
  • mvn -f springdoc-openapi-starter-webmvc-ui/pom.xml -Dtest=SpringDocApp40Test,SpringDocApp42Test test

Note

CI on spring-boot-4 currently also requires #3280, which aligns the springdoc-openapi-tests parent versions with the branch snapshot. This PR intentionally keeps only the Swagger UI index transformation fix.

@limehee limehee marked this pull request as ready for review April 26, 2026 08:36
@limehee limehee marked this pull request as draft April 26, 2026 08:37
@limehee limehee marked this pull request as ready for review April 26, 2026 09:02
@limehee limehee force-pushed the fix-swagger-index-nonce-cache branch from dc6bce2 to 49b90bc Compare April 26, 2026 09:20
Swagger UI index.html can be customized through SwaggerIndexTransformer, including CSP nonce injection, but cached resource handlers stored the first transformed index resource and reused it for later requests. Register index.html with the uncached Swagger UI handler patterns, matching swagger-initializer.js behavior, while retaining resource resolution caching.
@limehee limehee force-pushed the fix-swagger-index-nonce-cache branch from 49b90bc to 4720f6d Compare April 26, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant