如何在Apache CXF中配置Swagger UI的queryConfigEnabled参数？

问题背景 #

部署在Tomcat的Web应用通过Apache CXF集成Swagger展示REST接口，升级Swagger UI到4.x.x版本后，访问URL http://host:port/webappname/doc/api-docs?url=/webappname/doc/openapi.json#/ 始终显示默认Petstore API。原因是Swagger UI 4.x出于安全考虑默认禁用从URL读取配置参数，导致url参数被忽略；手动设置queryConfigEnabled=true未生效，需要在Apache CXF的OpenApiFeature中正确配置SwaggerUiConfig。

解决方案 #

方案1：在web.xml中直接配置OpenApiFeature（符合需求的配置示例） #

修改RestAPIDoc servlet的配置，通过CXF的特性参数配置方式，直接为OpenApiFeature设置SwaggerUiConfig的属性：

<servlet>
    <display-name>REST API Documentation</display-name>
    <servlet-name>RestAPIDoc</servlet-name>
    <servlet-class>org.apache.cxf.jaxrs.servlet.CXFNonSpringJaxrsServlet</servlet-class>
    <init-param>
        <param-name>jaxrs.serviceClasses</param-name>
        <param-value>com.abc.xyz.AgentManagerService</param-value>
    </init-param>
    <init-param>
        <param-name>jaxrs.features</param-name>
        <param-value>org.apache.cxf.jaxrs.openapi.OpenApiFeature</param-value>
    </init-param>
    <!-- 启用从URL读取配置参数 -->
    <init-param>
        <param-name>jaxrs.features.org.apache.cxf.jaxrs.openapi.OpenApiFeature.swaggerUiConfig.queryConfigEnabled</param-name>
        <param-value>true</param-value>
    </init-param>
    <!-- 配置默认OpenAPI文档地址（可选，避免依赖URL参数） -->
    <init-param>
        <param-name>jaxrs.features.org.apache.cxf.jaxrs.openapi.OpenApiFeature.swaggerUiConfig.url</param-name>
        <param-value>/oemanager/doc/openapi.json</param-value>
    </init-param>
    <init-param>
        <param-name>jaxrs.providers</param-name>
        <param-value>
            org.apache.cxf.jaxrs.provider.MultipartProvider,
            com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider
        </param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

方案2：修正MyApp类的配置（代码层面配置） #

原MyApp类中在getSingletons方法添加OpenApiFeature，可能与RestAPIDoc servlet中配置的OpenApiFeature冲突，导致配置不生效。建议只保留一处配置，修改MyApp类如下：

public class MyApp extends Application {
    private Set<Object> singletons = new HashSet<Object>();
    private Set<Class<?>> classes = new HashSet<Class<?>>();

    public MyApp() throws ServletException {
        try {
            singletons.add(new JSONProvider());
            singletons.add(new WARProvider());

            Context m_context = getNamingContext();
            
            RestTransportManagerService restTransportManagerService = new RestTransportManagerService(m_context);
            singletons.add(restTransportManagerService);

            SoapTransportManagerService soapTransportManagerService = new SoapTransportManagerService(m_context);
            singletons.add(soapTransportManagerService);

            AgentManagerService agentManagerService = new AgentManagerService();
            singletons.add(agentManagerService);

            // 初始化OpenApiFeature并配置SwaggerUiConfig
            final OpenApiFeature feature = new OpenApiFeature(); 
            feature.setSwaggerUiConfig(
                new SwaggerUiConfig()
                    .url("/oemanager/doc/openapi.json") 
                    .queryConfigEnabled(true)
            );
            singletons.add(feature);

        } catch (Exception e) {
            throw new ServletException(e.getMessage());
        }
    }

    private Context getNamingContext() throws NamingException{
        Context m_context = new InitialContext();
        return m_context.lookup("java:comp/env");
    }

    @Override
    public Set<Class<?>> getClasses() {
        return classes;
    }

    @Override
    public Set<Object> getSingletons() {
        return singletons;
    }
}

同时删除RestAPIDoc servlet中的jaxrs.features配置项，避免重复加载OpenApiFeature。

注意事项 #

• 若使用方案1，确保CXF版本为3.4.0及以上（该版本支持通过init-param配置Feature的嵌套属性），当前3.5.1版本满足要求。
• queryConfigEnabled=true存在安全风险，生产环境建议直接配置默认的url属性，避免依赖URL参数传递API地址。

内容的提问来源于stack exchange，提问作者Austin