title: Securing swagger ui in asp.net core
body: <p>First of all I should say that, I'm not native in English that may cause to misunderstanding on explanation.
  This issue is about Securing swagger ui in ASP.Net Core as describe <a href="https://medium.com/@niteshsinghal85/securing-swagger-in-production-92d0a045a5" rel="nofollow noreferrer">in this link</a> I have done it and it works well in Mozilla Firefox, Microsoft edge and Opera explorer  but it does not work in Google chrome.
  Chrome opens the swagger api page with out any alert or login information.
  Does anyone have a suggestion for configuration in startup.cs or any help on the subject?
  Here I paste some codes that did to solve it but it does not work on Chrome.</p>
  <pre><code>app.UseSwaggerAuthorized( );
  app.UseSwagger( );
  app.UseSwaggerUI( c =&gt; c.SwaggerEndpoint( &quot;/swagger/v1/swagger.json&quot;, &quot;Broker.Rest v1&quot; ) ); 
  </code></pre>
  <p>I think Chrome can not excute the &quot;UseSwaggerAuthorized&quot;. I test it in many ways.
  This is my UseSwaggerAuthorized method</p>
  <pre><code>public static class AuthorizedSampleClass
      {
          public static IApplicationBuilder UseSwaggerAuthorized( this IApplicationBuilder builder )
          {
              return builder.UseMiddleware&lt;SwaggerBasicAuthMiddleware&gt;( );
          }
      }
      
       public class SwaggerBasicAuthMiddleware
       {
              private readonly RequestDelegate next;
              public SwaggerBasicAuthMiddleware( RequestDelegate next )
              {
                  this.next = next;
              }
              public async Task InvokeAsync( HttpContext context )
              {
                  if ( context.Request.Path.StartsWithSegments( &quot;/swagger&quot; ) )
                  {
                      string authHeader = context.Request.Headers[ &quot;Authorization&quot; ];
                      if ( authHeader != null &amp;&amp; authHeader.StartsWith( &quot;Basic &quot; ) )
                      {
                          // Get the credentials from request header
                          var header = AuthenticationHeaderValue.Parse( authHeader );
                          var inBytes = Convert.FromBase64String( header.Parameter );
                          var credentials = Encoding.UTF8.GetString( inBytes ).Split( ':' );
                          var username = credentials[ 0 ];
                          var password = credentials[ 1 ];
                          // validate credentials
                          if ( username.Equals( &quot;a&quot; ) &amp;&amp; password.Equals( &quot;a&quot; ) )
                          {
                              await next.Invoke( context ).ConfigureAwait( false );
                              return;
                          }
                      }
                      context.Response.Headers[ &quot;WWW-Authenticate&quot; ] = &quot;Basic&quot;;
                      context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
                  }
                  else
                  {
                      await next.Invoke( context ).ConfigureAwait( false );
                  }
              }
      
          }
  </code></pre>
  <p>Chrome update, chrome bug, startup.cs settings, Lunchsetting.json, appsetting.json</p>