This is an automated email from the ASF dual-hosted git repository.
chaitalicod pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/atlas.git
The following commit(s) were added to refs/heads/master by this push:
new 0a7fc7d53 ATLAS-5309 : Allow unauthenticated access to Swagger apidocs
static assets (#673)
0a7fc7d53 is described below
commit 0a7fc7d533409a8db199e049c7f148f6bee5f9e7
Author: pareshd <[email protected]>
AuthorDate: Tue Jun 16 18:18:21 2026 +0530
ATLAS-5309 : Allow unauthenticated access to Swagger apidocs static assets
(#673)
Changes :-
Added /apidocs/** to security exclusions in
AtlasSecurityConfig.java and spring-security.xml to allow anonymous access to
Swagger UI assets and OpenAPI documentation.
Updated index.js to handle anonymous users and prevent CSRF-related
JavaScript errors when no session is available.
Testing
Verified Swagger UI and openapi.json are accessible without
authentication.
Confirmed Swagger UI loads successfully for anonymous users.
Co-authored-by: Paresh Devalia <[email protected]>
---
build-tools/src/main/resources/ui-dist/index.js | 5 +++++
.../main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java | 3 ++-
webapp/src/main/resources/spring-security.xml | 1 +
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/build-tools/src/main/resources/ui-dist/index.js
b/build-tools/src/main/resources/ui-dist/index.js
index 1644eabc4..0bf59b621 100644
--- a/build-tools/src/main/resources/ui-dist/index.js
+++ b/build-tools/src/main/resources/ui-dist/index.js
@@ -128,6 +128,11 @@
};
function fetchCsrfHeader() {
var response = getSessionDetails();
+
+ if (!response) {
+ return;
+ }
+
if (!csrfEnabled && response['atlas.rest-csrf.enabled']) {
var str = "" + response['atlas.rest-csrf.enabled'];
csrfEnabled = (str.toLowerCase() == 'true');
diff --git
a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
index 532f3319c..4ab0accaa 100644
---
a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
+++
b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
@@ -190,7 +190,8 @@ public class AtlasSecurityConfig extends
WebSecurityConfigurerAdapter {
"/libs/**", "/n/libs/**",
"/js/**", "/n/js/**",
"/ieerror.html", "/migration-status.html",
- "/api/atlas/admin/status"));
+ "/api/atlas/admin/status",
+ "/apidocs/**"));
if (!keycloakEnabled) {
matchers.add("/login.jsp");
diff --git a/webapp/src/main/resources/spring-security.xml
b/webapp/src/main/resources/spring-security.xml
index ea41d46ab..3d2d55bec 100644
--- a/webapp/src/main/resources/spring-security.xml
+++ b/webapp/src/main/resources/spring-security.xml
@@ -28,6 +28,7 @@
<security:http pattern="/ieerror.html" security="none" />
<security:http pattern="/api/atlas/admin/status" security="none" />
<security:http pattern="/api/atlas/admin/metrics" security="none" />
+ <security:http pattern="/apidocs/**" security="none" />
<security:http create-session="always"
entry-point-ref="entryPoint">
