Which reminds me, we've just added a repo of self ...

# http4k

[dave]

Which reminds me, we've just added a repo of self contained example projects which showcase the various features of http4k. If there's anything you'd like to see then please let us know! https://github.com/http4k/examples

[Mehdi]

so it similar to Query though, thanks @dave

[dave]

yep - we try to follow this: https://en.wikipedia.org/wiki/Principle_of_least_astonishment#:~:text=The%20principle%20of%20least%20astonishment,user%20interface%20and%20software%20design.&text=A%20more%20general%20statement%20of,will%20expect%20it%20to%20behave.

[dave]

🙂

[Mehdi]

Another question since I am using swagger ui How can I force swagger to get my customised header value and pass it to my API as a header value again?

[dave]

the header will be available on the incoming request - see that example to see how it works

[dave]

path parameters are extracted and passed to the function which creates the handler

[Mehdi]

I have bundled swagger ui in my project and pointed it into /my api/docs/swagger.json I want swagger to pass my header as well, so could I expect this from swagger?

[Mehdi]

routes += "/foo" meta {
    summary = "my summary"
    description = "my desc"
    headers += Header.string().required("auth_token")
    receiving(myLens to MyDTO())
}

[dave]

do you want to add a Security instead of a header?

[Mehdi]

yes I wanted to do that but for my case security is customised and I need to send auth_token as header value, I did not understand how to do it

[Mehdi]

could I do it using ApiKeySecurity?

[dave]

I think you want to use an ApiKeySecurity with that Header lense passed to the constructor: https://swagger.io/docs/specification/authentication/

[Mehdi]

yes exactly, this is what I was looking for

[Mehdi]

Thanks

[Mehdi]

Another question: What if I want to do Authentication with oauth service provider same as keyCloak?

[dave]

If it's standard oauth then it's built in, although we don't have a ready-made config for keycloak. There is an example of setting up the client config here: https://github.com/http4k/http4k-by-example/blob/master/src/main/kotlin/verysecuresystems/SecuritySystem.kt

[Mehdi]

Perfect I am falling in love with http4k

[Mehdi]

@dave how can I pass multiple headers params in ApiKeySecurity?

[dave]

you can only do one header per ApiKeySecurity

[dave]

you can compose the security instances with "this.and(that)"

[Mehdi]

but I can not combine two ApiKeySecurity right?

[dave]

you can

[dave]

I'm not sure what the UI will do TBH

[Mehdi]

UI shows the second one only

[dave]

you need to override the "name" for one of them

[dave]

class ApiKeySecurity<out T>(val param: Lens<Request, T>,
                            validateKey: (T) -> Boolean,
                            authorizeOptionsRequests: Boolean = true,
                            val name: String = "api_key") : Security {

[Mehdi]

This one fixed the UI but I do not know why it is not appending the second header

[Mehdi]

actually the second header for my case should be origin

[dave]

if works for me in my example of:

security = ApiKeySecurity(Header.required("foobar2"), { true}, true, name="bob2").and(ApiKeySecurity(Header.required("foobar"), { true}, true, name="bob"))

[dave]

you can see what it sends in the curl

curl -X GET "<http://localhost:9000/api/whoIsThere>" -H "accept: application/json" -H "foobar2: asd" -H "foobar: dsa"

[Mehdi]

I am trying to send it using swagger UI, I can see two authorise button in the UI because of the two fields

[Mehdi]

Ah I got it

[Mehdi]

as the second header name is `origin`as I mentioned and it is being overwritten somewhere

[dave]

cool. FYI: once you "execute" the swagger request, it shows the request that was sent as a curl. so you can see that it was doing the correct thing 🙂

[Mehdi]

How can I exclude some urls for the security? let say I want to exclude /ping

[dave]

Override the security for the route with NoSecurity

[Mehdi]

fun getMyRoute(): ContractRoute {
    val spec = "foo" / Path.of("name1") /  Path.of(name2) /"bar1" / "bar2" meta {
        summary = "summary"
        description = "description"
    } bindContract Method.PUT
    return spec to { s: String, s1: String, s2: String, s3: String -> ::myhandler() }
}

[Mehdi]

I do not get why I need to write spec to httpHandler like this to work.

[dave]

short answer - the kotlin type system isn't good enough

[dave]

🙂

[dave]

it's because of the way the lenses work

[Mehdi]

yes I guessed that, so I was wondering how does your samples work in the documents?

[dave]

it should all be consistent. can you show me if it's not pls?

[Mehdi]

It does not work on my case, the sample should be consistent

[dave]

so when you've got a suffix, you always end up with a "dead" parameter. This is unavoidable because of how the API works. the value injected into the lambda is always the value in quotes.

[dave]

for leading parameters, this is not the case

[dave]

(because it just concatenates the prefix)

[dave]

but once you have a dynamic parameter, we are forced to split it

[Mehdi]

yes I experienced exactly the same thing

[dave]

then it's working as expected 🙂