title: Documenting Spring's login/logout API in Swagger
body: <p>I am developing demo REST service using <code>Spring Boot</code> where user has to login in order to to perform certain subset of operations. After adding <code>Swagger UI</code> (using <code>springfox</code> library) with that simple configuration:</p>
  
  <pre><code>@Bean
  public Docket docApi() {
      return new Docket(DocumentationType.SWAGGER_2)
              .select()
                  .apis(any())
                  .paths(PathSelectors.ant("/api/**"))
                  .build()
              .pathMapping("/")
              .apiInfo(apiInfo())
              .directModelSubstitute(LocalDate.class, String.class)
              .useDefaultResponseMessages(true)
              .enableUrlTemplating(true);
  }
  </code></pre>
  
  <p>I end up with all apis with all operations listed on <code>Swagger UI</code> page. Unfortunately I don't have login/logout endpoints listed among them.</p>
  
  <p>The problem is that part of that operations cannot be performed via <code>Swagger UI</code> built-in form (I find it really nice feature and would like make it work), because user is not logged in. Is there any solution to that problem? Can I define manually some endpoints in <code>Swagger</code>?</p>
  
  <p>If there was a form to submit credentials (i.e. login/logout endpoints) I could perform authorization before using that secured endpoints. Then, <code>Swagger</code> user could extract <code>token/sessionid</code> from response and paste it to custom query parameter defined via <code>@ApiImplicitParams</code>.</p>
  
  <p>Below you can find my security configuration:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .formLogin()
                  .loginProcessingUrl("/api/login")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .successHandler(new CustomAuthenticationSuccessHandler())
                  .failureHandler(new CustomAuthenticationFailureHandler())
                  .permitAll()
                  .and()
              .logout()
                  .logoutUrl("/api/logout")
                  .logoutSuccessHandler(new CustomLogoutSuccessHandler())
                  .deleteCookies("JSESSIONID")
                  .permitAll()
                  .and()
              .csrf()
                  .disable()
              .exceptionHandling()
                  .authenticationEntryPoint(new CustomAuthenticationEntryPoint())
                  .and()
              .authorizeRequests()
              .and()
                  .headers()
                  .frameOptions()
                  .disable();
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth
              .userDetailsService(userDetailsService)
              .passwordEncoder(passwordEncoder());
  }
  </code></pre>