AuthenticateSwaggerUI 1.2.0

Swagger UI 2FA Authenticator for ASP.NET Web API

Protect your ASP.NET Framework Web API Swagger documentation with Two-Factor Authentication (2FA) using Time-Based One-Time Passwords (TOTP) like Google Authenticator.

This package securely locks down your /swagger endpoints, requires a valid 6-digit pin via native browser Basic Authentication, and utilizes HMAC-signed session cookies to ensure developers aren't constantly reprompted when navigating the docs.

✨ Features

• Google Authenticator Integration: Replaces standard static passwords with secure 6-digit TOTP codes.
• Smart Session Management: Generates an HMAC-SHA256 signed HTTP-only cookie upon successful login, keeping the session alive without repeatedly prompting for codes.
• Plug-and-Play Configuration: Easily injects into your existing Web API pipeline with a single extension method.

🚀 Quick Start

1. Installation

Use the NuGet Package Manager to install AuthenticateSwaggerUI.

PM> Install-Package AuthenticateSwaggerUI

2. Registration

To enable the 2FA protection, call the AuthenticateSwaggerUI extension method on your HttpConfiguration object. This is typically done inside your App_Start\WebApiConfig.cs file.

using System;
using System.Web.Http;
// Add the using statement for your package namespace here

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        // 1. Configure the Swagger Authenticator
        config.AuthenticateSwaggerUI(
            towFASecretKey: "YOUR_BASE32_SECRET_KEY", // The key entered into Google Authenticator (Use a UUID encoded in Base32 format recommended)
            cookeName: "SwaggerSecureSession",        // Name of the session cookie, Give a unique name to avoid conflicts with other cookies
            cookieSecret: "A_LONG_RANDOM_SECRET_KEY", // Used to cryptographically sign the cookie (Use a UUID encoded in SHA256 format recommended)
            twoFAUsername: "admin",                   // The username required in the Basic Auth prompt (Default: "admin"))
            revokeDuration: DateTime.UtcNow.AddHours(8) // Session duration (Default: 12 hours in UTC))
        );

        // 2. Standard Web API routes
        config.MapHttpAttributeRoutes();
        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
    }
}