This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch atlas-2.6 in repository https://gitbox.apache.org/repos/asf/atlas.git
commit 765c52ec78381dde733aaaf6fe7961d82c812f69 Author: pareshd <[email protected]> AuthorDate: Tue Jun 16 18:18:21 2026 +0530 ATLAS-5309 : Allow unauthenticated access to Swagger apidocs static assets (#673) Changes :- Added /apidocs/** to security exclusions in AtlasSecurityConfig.java and spring-security.xml to allow anonymous access to Swagger UI assets and OpenAPI documentation. Updated index.js to handle anonymous users and prevent CSRF-related JavaScript errors when no session is available. Testing Verified Swagger UI and openapi.json are accessible without authentication. Confirmed Swagger UI loads successfully for anonymous users. Co-authored-by: Paresh Devalia <[email protected]> --- build-tools/src/main/resources/ui-dist/index.js | 6 +++++- .../java/org/apache/atlas/web/security/AtlasSecurityConfig.java | 3 ++- webapp/src/main/resources/spring-security.xml | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/build-tools/src/main/resources/ui-dist/index.js b/build-tools/src/main/resources/ui-dist/index.js index 932df7bd90..92a971f73e 100644 --- a/build-tools/src/main/resources/ui-dist/index.js +++ b/build-tools/src/main/resources/ui-dist/index.js @@ -86,6 +86,10 @@ function fetchCsrfHeader() { var response = getSessionDetails(); + if (!response) { + return; + } + if (!csrfEnabled && response['atlas.rest-csrf.enabled']) { var str = "" + response['atlas.rest-csrf.enabled']; csrfEnabled = (str.toLowerCase() == 'true'); @@ -123,4 +127,4 @@ }); return response; }; -})(); \ No newline at end of file +})(); diff --git a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java index 532f3319ca..4ab0accaa9 100644 --- a/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java +++ b/webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java @@ -190,7 +190,8 @@ public class AtlasSecurityConfig extends WebSecurityConfigurerAdapter { "/libs/**", "/n/libs/**", "/js/**", "/n/js/**", "/ieerror.html", "/migration-status.html", - "/api/atlas/admin/status")); + "/api/atlas/admin/status", + "/apidocs/**")); if (!keycloakEnabled) { matchers.add("/login.jsp"); diff --git a/webapp/src/main/resources/spring-security.xml b/webapp/src/main/resources/spring-security.xml index ea41d46ab7..3d2d55bec4 100644 --- a/webapp/src/main/resources/spring-security.xml +++ b/webapp/src/main/resources/spring-security.xml @@ -28,6 +28,7 @@ <security:http pattern="/ieerror.html" security="none" /> <security:http pattern="/api/atlas/admin/status" security="none" /> <security:http pattern="/api/atlas/admin/metrics" security="none" /> + <security:http pattern="/apidocs/**" security="none" /> <security:http create-session="always" entry-point-ref="entryPoint">
