## Sobre seguridad, APIs y documentación { #about-security-apis-and-docs }

Ocultar las interfaces de usuario de la documentación en producción *no debería* ser la forma de proteger tu API.

Eso no añade ninguna seguridad extra a tu API, las *path operations* seguirán estando disponibles donde están.

Si hay una falla de seguridad en tu código, seguirá existiendo.

// existing ETag entry.
//
// Due to legacy S3 clients, that make incorrect assumptions
// about HTTP headers, Set should be used instead of
// http.Header.Set(...). Otherwise, some S3 clients will not
// able to extract the ETag.
func Set(etag ETag, h http.Header) {
	// Some (broken) S3 clients expect the ETag header to
	// literally "ETag" - not "Etag". Further, some clients
	// expect an ETag in double quotes. Therefore, we set the

}
```

So, it won't expect to be accessed at `http://127.0.0.1:8000/api/v1/app`.

Uvicorn will expect the proxy to access Uvicorn at `http://127.0.0.1:8000/app`, and then it would be the proxy's responsibility to add the extra `/api/v1` prefix on top.

## About proxies with a stripped path prefix { #about-proxies-with-a-stripped-path-prefix }

Keep in mind that a proxy with stripped path prefix is only one of the ways to configure it.

///

## Добавление дополнительной информации { #add-extra-information }

Вы можете объявлять дополнительную информацию в `Field`, `Query`, `Body` и т.п. Она будет включена в сгенерированную JSON схему.

An example could be that you have an external authentication provider that you need to call.

You send it a token and it returns an authenticated user.

This provider might be charging you per request, and calling it might take some extra time than if you had a fixed mock user for tests.

You probably want to test the external provider once, but not necessarily call it for every test that runs.

## About security, APIs, and docs { #about-security-apis-and-docs }

Hiding your documentation user interfaces in production *shouldn't* be the way to protect your API.

That doesn't add any extra security to your API, the *path operations* will still be available where they are.

If there's a security flaw in your code, it will still exist.

# Configure Swagger UI { #configure-swagger-ui }

You can configure some extra <a href="https://swagger.io/docs/open-source-tools/swagger-ui/usage/configuration/" class="external-link" target="_blank">Swagger UI parameters</a>.

To configure them, pass the `swagger_ui_parameters` argument when creating the `FastAPI()` app object or to the `get_swagger_ui_html()` function.

`swagger_ui_parameters` receives a dictionary with the configurations passed to Swagger UI directly.

    assertThat("Thu, 01 Jan 1970 00:00:00".toHttpDateOrNull()).isNull()
    // Missing seconds treated as bad.
    assertThat("Thu, 01 Jan 1970 00:00 GMT".toHttpDateOrNull()).isNull()
    // Extra spaces treated as bad.
    assertThat("Thu,  01 Jan 1970 00:00 GMT".toHttpDateOrNull()).isNull()
    // Missing leading zero treated as bad.
    assertThat("Thu, 1 Jan 1970 00:00 GMT".toHttpDateOrNull()).isNull()

        if (hasSkip) {
          return null; // Can't have more than one ::
        }
        hasSkip = true;
        partsSkipped++; // :: means we skipped an extra part in between the two delimiters.
        if (i == 0) {
          partsSkipped++; // Begins with ::, so we skipped the part preceding the first :
        }
        if (i == ipString.length() - 2) {

                    <table>
                        <thead><tr><td>Name</td><td>Extra column</td></tr></thead>
                        <tr><td>propName</td><td>some value</td></tr>
                    </table>
                </section>
            </chapter>
        ''')

        def extraAttribute = new ExtraAttributeDoc(parse('<td>Extra column</td>'), parse('<td>some value</td>'))