When deploying Spring Boot applications to production, it’s essential to completely disable the Swagger UI to avoid exposing API documentation and to pass automated security scans. This article outlines a practical approach to turn off Swagger, including hiding any residual Swagger‑related endpoints.

Step 1: Disable the Swagger Docket bean via a configuration property

Instead of hardcoding the enable flag, externalize it. The following configuration reads a boolean from api.doc.enabled in application.properties and applies it to the Docket bean.

@Configuration
@EnableSwagger2
public class ApiDocumentationConfig implements WebMvcConfigurer {

    @Value("${api.doc.enabled}")
    private boolean swaggerEnabled;

    @Bean
    public Docket apiDocket() {
        return new Docket(DocumentationType.SWAGGER_2)
                .enable(swaggerEnabled)
                .select()
                .apis(RequestHandlerSelectors.basePackage("com.example.myapp.controller"))
                .paths(PathSelectors.any())
                .build()
                .apiInfo(apiDetails());
    }

    private ApiInfo apiDetails() {
        return new ApiInfoBuilder()
                .version("2.0")
                .title("Internal API")
                .contact(new Contact("Dev Team", "", ""))
                .description("API documentation")
                .build();
    }
}

In application.properties (or the corresponding profile-specific file) set the flag to false for production:

api.doc.enabled=false

After this change, no Swagger controller endpoints are registered, and the Docket bean effectively stops generating any documentation. However, the default /swagger-ui.html path still returns a page (often with a "disabled" message). Most security scanners flag any response containing the word "swagger", so additional measures are needed.

Step 2: Return HTTP 404 for any Swagger‑related request

To ensure that automated vulnerability scans never see Swagger‑related content, intercept requests to paths like /swagger-ui.html and force a 404 response. Create a simple intercpetor:

public class SwaggerAccessInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) 
            throws Exception {
        String uri = request.getRequestURI();
        if (uri.contains("swagger") || uri.contains("api-docs")) {
            response.sendError(HttpServletResponse.SC_NOT_FOUND);
            return false;
        }
        return true;
    }
}

Register this interceptor in the existing WebMvcConfigurer implemantation:

@Override
public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new SwaggerAccessInterceptor())
            .addPathPatterns("/**");
}

Now every request whose URI contains "swagger" or "api-docs" receives a 404 status code, effectively hiding any trace of the Swagger UI from scanners and unauthorized users.