What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API definition files (i.e swagger) for nefarious means?
Publicly documenting your API gives attackers a head-start in identifying possible ways to abuse the API.
If you expect to host a functional Swagger UI page, ensure that your API's Cross-Origin Resource Sharing policy is not overly permissive, and that you have Cross-Site Request Forgery protections in place.
Similarly, take care to defend the Swagger UI page against frame-jacking, e.g., via the
Aside from those, consider these other business-related risks:
- your API document is a reflection of your organization, and so should not contain things like profanity
- your API may reveal exactly what sort of sensitive data it handles
- social security numbers and other PII would be a big draw for attackers
- your API may reveal your organization's business connections, for better or worse
- for example, if your API document includes a query parameter named "exclude_data_we_stole_from_the_fbi", you may attract attention from the FBI for stealing their data
- the frequency of updates to your API may signal your development or maintenance velocity to your competitors