AuthenticateSwaggerUI.Core 1.0.1

🛡️ Swagger & RapiDoc 2FA Authenticator for ASP.NET Core

A lightweight, secure middleware for ASP.NET Core applications that protects your Swagger UI and JSON endpoints using Basic Authentication combined with a Google Authenticator 2FA code. It also comes with built-in support for rendering beautiful RapiDoc documentation.

✨ Features

• Two-Factor Authentication (2FA): Secures your API docs using a 6-digit Time-Based One-Time Password (TOTP) from Google Authenticator.
• Built-in RapiDoc Support: Automatically serves a modern, dark-themed RapiDoc interface at the /docs endpoint.
• Stateless Session Security: Uses a securely signed, tamper-proof, and HTTP-only session cookie to maintain authentication.
• Static Asset Bypassing: Intelligently bypasses authentication for static UI assets (CSS, JS, images) to ensure fast rendering.
• Environment Aware: Configurable to bypass or enforce authentication during development.

🚀 Getting Started & Configuration

1. Installation

Use the NuGet Package Manager to install AuthenticateSwaggerUI.Core.

PM> Install-Package AuthenticateSwaggerUI.Core

2. Register the Middleware in Program.cs

Add the middleware to your request pipeline. Make sure to place it before app.UseSwagger() and app.UseSwaggerUI().

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

// Configure the authentication middleware
app.AuthenticateSwaggerUI(
    twoFAUsername: "admin", // The username required in the Basic Auth prompt (Default: "admin"))
    twoFASecretKey: "YOUR_BASE32_ENCODED_GOOGLE_AUTH_SECRET", // The key entered into Google Authenticator (Use a UUID encoded in Base32 format recommended)
    cookeName: "ApiDocSession", // Name of the session cookie, Give a unique name to avoid conflicts with other cookies
    cookieSecret: "A_VERY_STRONG_RANDOM_SECRET_KEY_FOR_HMAC_SIGNATURE", // Used to cryptographically sign the cookie (Use a UUID encoded in SHA256 format recommended)
    revokeDuration: DateTime.UtcNow.AddHours(8), //// Session duration (Default: 12 hours in UTC))
    enableOnDevelopment: false // Set to true to enable authentication in development environment (Default: true))
);

// Standard ASP.NET Core pipeline...
app.Run();