Mask password fields

[drwelby]

OpenAPI supports optional "formats" on certain types:

https://spec.openapis.org/oas/v3.1.0#data-types

One of these is format: password for hinting to clients to mask the input.

This would be a useful addition so that docs can be used in demos and screencasts without revealing the presenter's password.

[drwelby]

I'm not very fluent in Typescript but after poking around I think that this could work with the existing components with

password = {param.format} or maybe password = {param.format | false} around here:

docusaurus-openapi-docs/packages/docusaurus-theme-openapi-docs/src/theme/ApiExplorer/ParamOptions/ParamFormItems/ParamTextFormItem.tsx

Line 23 in a3b467c

paramName={param.name}

The question then is what should happen in the code samples - could they render as asterisks?

[sserrata]

Hi @drwelby, we looked at masking password input in the past but, since they are ultimately displayed in code snippets, it seemed like a moot point. Still, there may be some value in masking the input field since it's more visible.

I suppose we could find a way to mask in code snippets but still send the real password when "Send API Request" is clicked.

[avivace]

@sserrata what also is a bit unclear in this case is that there are other cases (e.g. a bearer token) that are masked (and as you said they are also displayed in code snippets) so the behaviour is a bit inconsistent