.NET 9下Swagger UI的Authorize按钮不显示如何解决？

在.NET 8中使用AddEndpointsApiExplorer+UseSwagger配合AddSwaggerGen的安全配置时，Swagger UI的Authorize按钮正常显示，但升级到.NET 9改用AddOpenApi+MapOpenApi后，按钮消失。

原因 #

.NET 9引入的AddOpenApi是独立的OpenAPI文档生成器，默认不会共享AddSwaggerGen中配置的安全定义。当前代码中MapOpenApi()暴露的是AddOpenApi生成的文档，这份文档未包含AddSwaggerGen里的Bearer认证配置，因此Swagger UI无法识别并显示Authorize按钮。

解决方法 #

方法1：沿用.NET 8的配置模式（快速恢复） #

将配置改回与.NET 8一致的组合，让SwaggerUI加载AddSwaggerGen生成的文档：

1. 替换AddOpenApi为AddEndpointsApiExplorer
2. 替换MapOpenApi()为UseSwagger()

修改后的核心代码：

public class Program
{
    public static void Main(string[] args)
    {
        var builder = WebApplication.CreateBuilder(args);
        builder.Services.AddControllers();
        // 替换AddOpenApi为AddEndpointsApiExplorer
        builder.Services.AddEndpointsApiExplorer();
        builder.Services.AddSwaggerGen(options =>
        {
            options.AddSecurityDefinition("bearerAuth", new()
            {
                Type = SecuritySchemeType.Http,
                In = ParameterLocation.Header,
                Scheme = "Bearer",
                BearerFormat = "JWT",
                Name = "Authorization",
                Description = "Enter your bearer token"
            });
            options.AddSecurityRequirement(new()
            {
                {
                    new()
                    {
                        Reference = new()
                        {
                            Type = ReferenceType.SecurityScheme,
                            Id = "bearerAuth"
                        }
                    },
                    Array.Empty<string>()
                }
            });
        });
        var app = builder.Build();
        if (app.Environment.IsDevelopment())
        {
            // 替换MapOpenApi()为UseSwagger()
            app.UseSwagger();
            app.UseSwaggerUI(options =>
            {
                options.SwaggerEndpoint("/swagger/v1/swagger.json", "v1");
            });
            app.MapGet("/", async context =>
            {
                await Task.Run(() => context.Response.Redirect("./swagger/index.html", permanent: false));
            });
        }
        app.UseHttpsRedirection();
        app.UseAuthorization();
        app.MapControllers();
        app.Run();
    }
}

方法2：基于.NET 9的AddOpenApi配置认证 #

如果想保留.NET 9的新API，直接在AddOpenApi中配置安全定义，无需依赖AddSwaggerGen（如果不需要SwaggerGen的其他功能）：

public class Program
{
    public static void Main(string[] args)
    {
        var builder = WebApplication.CreateBuilder(args);
        builder.Services.AddControllers();
        builder.Services.AddOpenApi(options =>
        {
            options.OpenApiVersion = Microsoft.OpenApi.OpenApiSpecVersion.OpenApi3_0;
            // 在AddOpenApi中添加安全定义
            options.AddSecurityDefinition("bearerAuth", new Microsoft.OpenApi.Models.OpenApiSecurityScheme
            {
                Type = Microsoft.OpenApi.Models.SecuritySchemeType.Http,
                In = Microsoft.OpenApi.Models.ParameterLocation.Header,
                Scheme = "Bearer",
                BearerFormat = "JWT",
                Name = "Authorization",
                Description = "Enter your bearer token"
            });
            // 添加安全要求
            options.AddSecurityRequirement(new Microsoft.OpenApi.Models.OpenApiSecurityRequirement
            {
                {
                    new Microsoft.OpenApi.Models.OpenApiSecurityScheme
                    {
                        Reference = new Microsoft.OpenApi.Models.OpenApiReference
                        {
                            Type = Microsoft.OpenApi.Models.ReferenceType.SecurityScheme,
                            Id = "bearerAuth"
                        }
                    },
                    Array.Empty<string>()
                }
            });
        });
        var app = builder.Build();
        if (app.Environment.IsDevelopment())
        {
            app.MapOpenApi();
            app.UseSwaggerUI(options =>
            {
                options.SwaggerEndpoint("/openapi/v1.json", "v1");
            });
            app.MapGet("/", async context =>
            {
                await Task.Run(() => context.Response.Redirect("./swagger/index.html", permanent: false));
            });
        }
        app.UseHttpsRedirection();
        app.UseAuthorization();
        app.MapControllers();
        app.Run();
    }
}

说明 #

两种方法任选其一即可：

• 方法1适合希望保持原有配置习惯、快速解决问题的场景；
• 方法2适合拥抱.NET 9新特性、不想依赖SwaggerGen额外配置的场景。

内容的提问来源于stack exchange，提问作者Mr. X