fix: use X-User-Agent for Swagger API requests

- fixes: #2456

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/middleware/vcio_user_agent.py

@@ -24,8 +24,9 @@ def __call__(self, request):
             ("/api/docs/", "/api/schema/")
         ):
             user_agent = request.headers.get("User-Agent", "")
+            x_user_agent = request.headers.get("X-User-Agent", "")
             docs_url = request.build_absolute_uri("/api/docs/")
-            if user_agent != settings.VCIO_USER_AGENT:
+            if settings.VCIO_USER_AGENT not in [user_agent, x_user_agent]:
                 return JsonResponse(
                     {
                         "detail": (

vulnerabilities/templates/drf_spectacular/swagger_ui.html

@@ -33,8 +33,8 @@
         swaggerSettings.dom_id = "#swagger-ui";
 
         swaggerSettings.requestInterceptor = (request) => {
-            const userAgent = swaggerSettings.userAgent || "VCIO_API_AGENT";
-            request.headers['User-Agent'] = userAgent;
+            const xUserAgent = swaggerSettings.xUserAgent || "VCIO_API_AGENT";
+            request.headers['X-User-Agent'] = xUserAgent;
             return request;
         };
 

vulnerablecode/settings.py

@@ -329,7 +329,7 @@
         "defaultModelsExpandDepth": 1,
         "displayRequestDuration": True,
         "docExpansion": "list",
-        "userAgent": VCIO_USER_AGENT,
+        "xUserAgent": VCIO_USER_AGENT,
     },
     "AUTHENTICATION_WHITELIST": [
         "rest_framework.authentication.TokenAuthentication",