Which Swagger UI endpoints remain publicly accessible without security scheme configuration?

Answer

When the hosting web server does not enforce authentication and the OpenAPI document contains no securityDefinitions (OpenAPI 2) or components.securitySchemes (OpenAPI 3) section, the following Swagger UI resources are reachable by anyone:

• The main HTML interface – typically /swagger-ui.html or /swagger-ui/index.html.
• The OpenAPI description endpoint – commonly /v2/api-docs for Springfox (OpenAPI 2) or /openapi.json / /openapi.yaml for Springdoc/OpenAPI 3.
• Auxiliary UI configuration files served under /swagger-resources, such as /swagger-resources/configuration/ui and /swagger-resources/configuration/security.

Confirmed facts

1. The Swagger UI HTML file is a static resource; it is served regardless of the spec’s security section.
2. The OpenAPI JSON/YAML endpoint returns the full description without requiring credentials when the API framework does not attach authentication middleware to that route.
3. The auxiliary /swagger-resources/* files are also static and needed for UI rendering; they are publicly reachable by default.
4. Security schemes (API key, OAuth2, etc.) are only rendered in the UI when the spec contains a non‑empty securityDefinitions or components.securitySchemes block; otherwise the UI shows no lock icon and the “Authorize” button is absent.

Likely explanation

Swagger UI is designed to work out‑of‑the‑box: it loads the HTML, fetches the spec, and then builds the interface. If the spec lacks any security section, the UI has nothing to display in the authorization panel, so it omits the lock icon and does not add an Authorization header to requests made via the “Try it out” button. Consequently, the browser sends raw requests directly to the backend endpoints, which may succeed if those endpoints themselves do not enforce request‑level authorization.

Verification steps (no auth middleware)

1. Start the application with no security scheme defined in the OpenAPI document and with the web server’s authentication disabled.
2. From an incognito browser window, request http://<host>/swagger-ui.html (or the configured UI path). A 200 response containing the Swagger UI HTML confirms public access.
3. Request the spec endpoint, e.g., http://<host>/v2/api-docs or http://<host>/openapi.json. A 200 response with JSON/YAML confirms the description is publicly introspectable.
4. Open the browser’s DevTools Network tab, click “Try it out” on any operation, and observe that the outgoing request lacks an Authorization header.
5. Add a minimal security definition (e.g., an API key) to the spec, restart, and reload the UI; the “Authorize” button should appear, showing that schemes are rendered only when present in the document.

Missing diagnostic detail

If your deployment uses a non‑default UI path (e.g., behind a prefix or a custom servlet mapping), please confirm the exact URL used for /swagger-ui.html so the verification steps can be adjusted accordingly.