NestJS · Senior · Question 48 of 75

What's a concern with exposing Swagger UI in production?

1Swagger UI doesn't work in production
2Swagger UI slows down every request
✓Correct answer: It reveals the full API surface; restrict it with auth or disable it, while still publishing the spec where clients need it

Explanation

Internal endpoints listed in the docs make attackers' reconnaissance easier.

Further reading

Test yourself

Take the NestJS · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.