app.register(helmet, { contentSecurityPolicy: { directives: { defaultSrc: [`'self'`], styleSrc: [`'self'`, `'unsafe-inline'`], imgSrc: [`'self'`, 'data:', 'validator.swagger.io'], scriptSrc: [`'self'`, `https: 'unsafe-inline'`], }, },});// If you are not going to use CSP at all, you can use this:app.register(helmet, { contentSecurityPolicy: false,});
export interface SwaggerDocumentOptions { /** * List of modules to include in the specification */ include?: Function[]; /** * Additional, extra models that should be inspected and included in the specification */ extraModels?: Function[]; /** * If `true`, swagger will ignore the global prefix set through `setGlobalPrefix()` method */ ignoreGlobalPrefix?: boolean; /** * If `true`, swagger will also load routes from the modules imported by `include` modules */ deepScanRoutes?: boolean; /** * Custom operationIdFactory that will be used to generate the `operationId` * based on the `controllerKey`, `methodKey`, and version. * @default () => controllerKey_methodKey_version */ operationIdFactory?: OperationIdFactory; /** * Custom linkNameFactory that will be used to generate the name of links * in the `links` field of responses * * @see [Link objects](https://swagger.io/docs/specification/links/) * * @default () => `${controllerKey}_${methodKey}_from_${fieldKey}` */ linkNameFactory?: ( controllerKey: string, methodKey: string, fieldKey: string ) => string; /* * Generate tags automatically based on the controller name. * If `false`, you must use the `@ApiTags()` decorator to define tags. * Otherwise, the controller name without the suffix `Controller` will be used. * @default true */ autoTagControllers?: boolean;}
export interface SwaggerCustomOptions { /** * If `true`, Swagger resources paths will be prefixed by the global prefix set through `setGlobalPrefix()`. * Default: `false`. * @see ../faq/global-prefix */ useGlobalPrefix?: boolean; /** * If `false`, the Swagger UI will not be served. Only API definitions (JSON and YAML) * will be accessible (on `/{path}-json` and `/{path}-yaml`). To fully disable both the Swagger UI and API definitions, use `raw: false`. * Default: `true`. * @deprecated Use `ui` instead. */ swaggerUiEnabled?: boolean; /** * If `false`, the Swagger UI will not be served. Only API definitions (JSON and YAML) * will be accessible (on `/{path}-json` and `/{path}-yaml`). To fully disable both the Swagger UI and API definitions, use `raw: false`. * Default: `true`. */ ui?: boolean; /** * If `true`, raw definitions for all formats will be served. * Alternatively, you can pass an array to specify the formats to be served, e.g., `raw: ['json']` to serve only JSON definitions. * If omitted or set to an empty array, no definitions (JSON or YAML) will be served. * Use this option to control the availability of Swagger-related endpoints. * Default: `true`. */ raw?: boolean | Array<'json' | 'yaml'>; /** * Url point the API definition to load in Swagger UI. */ swaggerUrl?: string; /** * Path of the JSON API definition to serve. * Default: `<path>-json`. */ jsonDocumentUrl?: string; /** * Path of the YAML API definition to serve. * Default: `<path>-yaml`. */ yamlDocumentUrl?: string; /** * Hook allowing to alter the OpenAPI document before being served. * It's called after the document is generated and before it is served as JSON & YAML. */ patchDocumentOnRequest?: <TRequest = any, TResponse = any>( req: TRequest, res: TResponse, document: OpenAPIObject ) => OpenAPIObject; /** * If `true`, the selector of OpenAPI definitions is displayed in the Swagger UI interface. * Default: `false`. */ explorer?: boolean; /** * Additional Swagger UI options */ swaggerOptions?: SwaggerUiOptions; /** * Custom CSS styles to inject in Swagger UI page. */ customCss?: string; /** * URL(s) of a custom CSS stylesheet to load in Swagger UI page. */ customCssUrl?: string | string[]; /** * URL(s) of custom JavaScript files to load in Swagger UI page. */ customJs?: string | string[]; /** * Custom JavaScript scripts to load in Swagger UI page. */ customJsStr?: string | string[]; /** * Custom favicon for Swagger UI page. */ customfavIcon?: string; /** * Custom title for Swagger UI page. */ customSiteTitle?: string; /** * File system path (ex: ./node_modules/swagger-ui-dist) containing static Swagger UI assets. */ customSwaggerUiPath?: string; /** * @deprecated This property has no effect. */ validatorUrl?: string; /** * @deprecated This property has no effect. */ url?: string; /** * @deprecated This property has no effect. */ urls?: Record<'url' | 'name', string>[];}
提示ui 和 raw 是独立选项。禁用 Swagger UI (ui: false) 不会禁用 API 定义 (JSON/YAML)。反之,禁用 API 定义 (raw: []) 也不会影响 Swagger UI 的使用。
例如,以下配置将禁用 Swagger UI 但仍允许访问 API 定义:
const options: SwaggerCustomOptions = { ui: false, // Swagger UI is disabled raw: ['json'], // JSON API definition is still accessible (YAML is disabled)};SwaggerModule.setup('api', app, documentFactory, options);