How to conditionally disable authentication component? #1142

olivierauverlot · 2025-12-04T16:47:06Z

olivierauverlot
Dec 4, 2025

Hi,

I'm developing a RESTful API using SQLPage and have created a Swagger file to document the API.

I'm experiencing an issue with two services that use HTTP Basic Authentication to restrict access. These services employ an authentication component.

When Swagger UI attempts to test the service, it first sends an OPTIONS request followed by a GET request. Since the service is password-protected and Swagger UI does not transmit credentials with the OPTIONS verb, the service returns a 401 error code.

How can I disable authentication specifically for OPTIONS requests?

Best regards
Olivier

anntnzrb · 2025-12-04T17:07:49Z

anntnzrb
Dec 4, 2025

Use sqlpage.request_method() in a WHERE clause to conditionally disable auth:

SELECT 'authentication' AS component,
       'your_password_hash' AS password_hash,
       :password AS password
WHERE sqlpage.request_method() != 'OPTIONS';

This allows OPTIONS requests (CORS preflight) to pass through unauthenticated while maintaining security for GET/POST requests.

1 reply

olivierauverlot Dec 4, 2025
Author

Yes, this solution works, but in my specific scenario, I also require the user's login credentials.

SELECT 'authentication' AS component,
    case sqlpage.basic_auth_username()
        when 'admin'
            then '$argon2i$v=19$m=8,t=1,p=1$YWFhYWFhYWE$oKBq5E8XFTHO2w' 
        when 'user'
            then '$argon2i$v=19$m=8,t=1,p=1$YWFhYWFhYWE$qsrWdjgl96ooYw' 
    end AS password_hash, 
    sqlpage.basic_auth_password() AS password
WHERE sqlpage.request_method() != 'OPTIONS';

In this scenario, I receive a 401 Unauthorized error because the sqlpage.basic_auth_name() function returns no value.

lovasoa · 2025-12-04T18:50:14Z

lovasoa
Dec 4, 2025
Maintainer

You most likely do not want to disable authentication.

The request you are mentioning is probably a cors preflight:

0 replies

lovasoa · 2025-12-04T19:24:53Z

lovasoa
Dec 4, 2025
Maintainer

@olivierauverlot The easiest fix is to host the swagger ui on the same domain as the api itself

5 replies

olivierauverlot Dec 4, 2025
Author

I am testing the Swagger file on my computer using localhost, and SQLPage is also running on my computer. They are using two different TCP ports, but this seems to be enough for Swagger UI to consider that it needs to use CORS.

lovasoa Dec 4, 2025
Maintainer

Yes, different ports are different origins. Your problem is not in swagger ui, any JavaScript code running from a different origin will have the browser trigger a preflight request before a non-GET request to your api.

The easiest is to serve your static swagger ui directly from SQLPage

lovasoa Dec 5, 2025
Maintainer

You should be able to just put a documentation.html file along your .json file, served directly by sqlpage, and use it to render the ui

https://github.com/swagger-api/swagger-ui/blob/HEAD/docs/usage/installation.md#unpkg

olivierauverlot Dec 6, 2025
Author

Thank you for your responses, which helped me integrate an OpenAPI document into my project.

I created a small shell-swagger-ui component to ensure a clean implementation. It is a simple HTML page that loads the Swagger-UI code via the unpkg CDN.

<!DOCTYPE html>
<html{{#if language}} lang="{{language}}{{/if}}">
  <head>
    <meta charset="{{default charset "utf-8"}}" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <meta name="description" content="SwaggerUI" />
    <title>{{default title "Swagger UI"}}</title>
    <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@{{default version "5.11.0"}}/swagger-ui.css" />
  </head>
  <body>
  <div id="swagger-ui"></div>
    <script nonce="{{@csp_nonce}}" src="https://unpkg.com/swagger-ui-dist@{{default version "5.11.0"}}/swagger-ui-bundle.js" crossorigin></script>
    <script nonce="{{@csp_nonce}}">
      window.onload = () => {
        window.ui = SwaggerUIBundle({
          url: '{{documentation}}',
          dom_id: '#swagger-ui',
        });
      };
    </script>  
  </body>
</html>

The endpoint /api/v2/openapi.sql for accessing the documentation is simply a component with a few parameters, such as the page title and the path to the OpenAPI file formatted in YAML.

SELECT
    'shell-swagger-ui'                  AS component,
    'Swagger Demo'                     AS title,
    'fr'                                AS language,
    'utf-8'                             AS charset,
    'swagger/openapi.yaml'               AS documentation,
    '5.11.0'                            AS version;

@lovasoa I'm not sure if this type of component would be beneficial to add to the standard components of SQLPage. It doesn't seem to have general applicability. What are your thoughts on this?

Best regards
Olivier

lovasoa Dec 6, 2025
Maintainer

Indeed, I don't think we should upstream this before we have more support for building APIs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

How to conditionally disable authentication component? #1142

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 6 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

How to conditionally disable authentication component? #1142

Uh oh!

olivierauverlot Dec 4, 2025

Replies: 3 comments · 6 replies

Uh oh!

anntnzrb Dec 4, 2025

Uh oh!

olivierauverlot Dec 4, 2025 Author

Uh oh!

lovasoa Dec 4, 2025 Maintainer

Uh oh!

lovasoa Dec 4, 2025 Maintainer

Uh oh!

olivierauverlot Dec 4, 2025 Author

Uh oh!

lovasoa Dec 4, 2025 Maintainer

Uh oh!

lovasoa Dec 5, 2025 Maintainer

Uh oh!

olivierauverlot Dec 6, 2025 Author

Uh oh!

lovasoa Dec 6, 2025 Maintainer

olivierauverlot
Dec 4, 2025

Replies: 3 comments 6 replies

anntnzrb
Dec 4, 2025

olivierauverlot Dec 4, 2025
Author

lovasoa
Dec 4, 2025
Maintainer

lovasoa
Dec 4, 2025
Maintainer

olivierauverlot Dec 4, 2025
Author

lovasoa Dec 4, 2025
Maintainer

lovasoa Dec 5, 2025
Maintainer

olivierauverlot Dec 6, 2025
Author

lovasoa Dec 6, 2025
Maintainer