...
- ✅ Valid token → Controller executes, returns response (200 OK)
- ❌ Invalid token → Authentication fails, returns 401 Unauthorized
- Swagger UI displays the response
...
Environment-Based Access Control
Swagger UI access varies by environment for security:
Development Environment (Local)
- Access: Fully open - anyone on localhost can use Swagger
- URL:
http://localhost:7532/swaggerorhttp://localhost:7098/swagger
Testing/Staging/UAT Environments
- Access: IP whitelist required - only approved IP addresses can access
- Restriction: Returns 403 Forbidden if IP not on whitelist
- 📄 See: Swagger IP Whitelisting Documentation
Production Environment
- Access: Completely disabled for security
- Result: Swagger endpoints return 404 Not Found
...
Token Details
Access Token (JWT)
Purpose: Proves developer is authenticated and authorized to call API endpoints
Lifetime: 1 hour
What's in the token:
- Audience: Which API this token is for (ApiService or IntegrationServiceAPI)
- Issuer: Microsoft Entra ID (proves it came from Azure AD)
- Expiration: When the token expires
- User identity: Developer's name and email
- Permissions: What the developer can access (scope)
- Signature: Cryptographic proof the token is authentic
When token expires:
- After 1 hour, developer must click "Authorize" again
- No automatic refresh (unlike the Web app)
- Lock icons change back to open (grayed out)
...
Security Mechanisms
PKCE (Proof Key for Code Exchange)
What it does: Protects the authorization code during the OAuth2 flow Why it matters: Prevents attackers from stealing and using authorization codes How it works: Swagger UI automatically generates a secret code that only it knows, making stolen authorization codes useless
...
Token Signature Validation
What it does: Verifies each token was actually issued by Microsoft Why it matters: Prevents forged or tampered tokens How it works: Azure AD signs tokens with a private key, and the API verifies the signature using Azure AD's public key
...
Token Expiration
What it does: Tokens automatically expire after 1 hour Why it matters: Limits damage if a token is stolen What happens: Developer must re-authorize in Swagger to get a new token
...
Audience Validation
What it does: Ensures tokens are used for the intended API only Why it matters: Prevents using an ApiService token for IntegrationServiceAPI (and vice versa) How it works: Each API only accepts tokens specifically issued for it
...
Issuer Validation
What it does: Verifies tokens come from the correct Azure AD tenant Why it matters: Prevents tokens from other organizations' Azure AD How it works: API only accepts tokens from the configured tenant ID