API documentation accessible only to authorized users

Publicly accessible API documentation — Swagger UI, Redoc, GraphQL Playground — hands attackers a complete, interactive map of your API surface. CWE-200 (Exposure of Sensitive Information) and OWASP API Security Top 10 2023 API8 (Security Misconfiguration) both target documentation exposure as a misconfiguration that eliminates reconnaissance effort. Schema docs reveal endpoint names, parameter types, authentication methods, and sometimes internal implementation details through field names and descriptions. Attackers use publicly available Swagger specs to auto-generate exploit code targeting specific endpoints. Intentionally public APIs (developer platforms, open standards) are a legitimate exception — but this must be a deliberate choice, not a default.

Gate API documentation behind authentication middleware or restrict it to internal IP ranges. Disable interactive exploration (GraphQL Playground, Swagger's 'Try it out') in production entirely.

// Express + Swagger UI
import swaggerUi from 'swagger-ui-express'
import spec from './openapi.json'

// Apply admin-only auth middleware before mounting the docs
app.use(
  '/api/docs',
  requireAuth,
  requireRole('admin'),
  swaggerUi.serve,
  swaggerUi.setup(spec, {
    swaggerOptions: { tryItOutEnabled: false }  // disable interactive execution
  })
)

// Or disable entirely in production and ship docs to a separate internal tool:
if (process.env.NODE_ENV !== 'production') {
  app.use('/api/docs', swaggerUi.serve, swaggerUi.setup(spec))
}

If documentation must be public (developer platform), scrub internal endpoints and strip sensitive field descriptions before generating the public spec.