如何在项目中实现Swagger验证权限功能，点击按钮完成校验流程

以下分别给出目前主流的两种Swagger集成场景的可运行实现：

场景1：SpringBoot + SpringDoc（OpenAPI 3.x，目前主流推荐） #

• 第一步：引入Maven依赖

<dependency>
    <groupId>org.springdoc</groupId>
    <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
    <version>2.2.0</version>
</dependency>

• 第二步：新增OpenAPI配置类

import io.swagger.v3.oas.models.Components;
import io.swagger.v3.oas.models.OpenAPI;
import io.swagger.v3.oas.models.security.SecurityRequirement;
import io.swagger.v3.oas.models.security.SecurityScheme;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class SwaggerConfig {

    @Bean
    public OpenAPI customOpenAPI() {
        // 定义安全方案，这里用JWT Bearer认证为例
        SecurityScheme securityScheme = new SecurityScheme()
                .type(SecurityScheme.Type.HTTP)
                .scheme("bearer")
                .bearerFormat("JWT")
                .name("Authorization")
                .in(SecurityScheme.In.HEADER);
        
        // 全局添加安全校验要求，所有接口默认需要携带认证信息
        SecurityRequirement securityRequirement = new SecurityRequirement().addList("BearerAuth");
        
        return new OpenAPI()
                .components(new Components().addSecuritySchemes("BearerAuth", securityScheme))
                .addSecurityItem(securityRequirement)
                .info(new io.swagger.v3.oas.models.info.Info()
                        .title("项目接口文档")
                        .version("1.0"));
    }
}

• 功能验证：启动项目后访问SwaggerUI地址（默认是http://{ip}:{port}/swagger-ui.html），右上角会出现Authorize按钮，点击后输入你的权限凭证（比如JWT令牌），点击授权后所有接口调用都会自动在请求头携带Authorization: Bearer {你的令牌}，后端直接按原有权限逻辑校验即可。

场景2：SpringBoot + SpringFox（Swagger 2.x 旧版本） #

• 第一步：引入Maven依赖

<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-swagger2</artifactId>
    <version>2.9.2</version>
</dependency>
<dependency>
    <groupId>io.springfox</groupId>
    <artifactId>springfox-swagger-ui</artifactId>
    <version>2.9.2</version>
</dependency>

• 第二步：新增Swagger2配置类

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.PathSelectors;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.service.ApiKey;
import springfox.documentation.service.AuthorizationScope;
import springfox.documentation.service.SecurityReference;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spi.service.contexts.SecurityContext;
import springfox.documentation.spring.web.plugins.Docket;
import springfox.documentation.swagger2.annotations.EnableSwagger2;

import java.util.Collections;
import java.util.List;

@Configuration
@EnableSwagger2
public class Swagger2Config {

    @Bean
    public Docket createRestApi() {
        return new Docket(DocumentationType.SWAGGER_2)
                .apiInfo(new ApiInfoBuilder()
                        .title("项目接口文档")
                        .version("1.0")
                        .build())
                .select()
                .apis(RequestHandlerSelectors.basePackage("你的Controller包路径"))
                .paths(PathSelectors.any())
                .build()
                // 配置安全校验
                .securitySchemes(securitySchemes())
                .securityContexts(securityContexts());
    }

    private List<ApiKey> securitySchemes() {
        // 配置请求头参数名
        return Collections.singletonList(new ApiKey("BearerAuth", "Authorization", "header"));
    }

    private List<SecurityContext> securityContexts() {
        return Collections.singletonList(SecurityContext.builder()
                .securityReferences(securityReferences())
                .build());
    }

    private List<SecurityReference> securityReferences() {
        AuthorizationScope scope = new AuthorizationScope("global", "全局权限");
        return Collections.singletonList(new SecurityReference("BearerAuth", new AuthorizationScope[]{scope}));
    }
}

• 功能验证：启动后访问SwaggerUI，右上角点击Authorize按钮，输入Bearer {你的令牌}，点击授权即可生效。

常见问题排查 #

• 如果授权后请求没有携带认证头：检查配置里的安全方案名称是否和SecurityRequirement里的名称完全一致
• 如果请求提示跨域：后端跨域配置需要把Authorization加入允许的请求头列表，同时放行Swagger相关的静态资源路径

内容的提问来源于stack exchange，提问作者Andhra Pradesh