How can I protect the loopback explorer by username and password?

Question

I've just started using loopback4 and I would like to protect the /explorer from being public. The user would initially see a page where username and password must be entered. If successful, the user is redirected to /explorer where he can see all API methods (and execute them). If user is not authenticated, accessing the path /explorer would give a response of "Unauthorized". Is there a way to easily implement this?

score 0 · Answer 1 · answered Jul 27 '20 at 19:31

There is issue talking about a GLOBAL default strategy is enabled for all routes including explorer in https://github.com/strongloop/loopback-next/issues/5758

The way is to specify a global metadata through the options:

this.configure(AuthenticationBindings.COMPONENT).to({
  defaultMetadata: {
    strategy: 'JWTStrategy'
  }
})
this.component(AuthenticationComponent);
registerAuthenticationStrategy(this, JWTAuthenticationStrategy)

But in terms of enabling a single endpoint added by route.get(), it's not supported yet, see code of how explorer is registered. @loopback/authentication retrieves auth strategy name from a controller class or its members, but if the route is not defined in the controller, it can only fall back to the default options, see implementation

How can I protect the loopback explorer by username and password?

1 Answers1