which is odd since inheriting from the base controller ought to do that, but maybe there is something missing in the swagger spec.. I think you may be missing this line in the composer, perhaps?

csharp
            // Enable Umbraco authentication for the "Example" Swagger document
            // PR: https://github.com/umbraco/Umbraco-CMS/pull/15699
            opt.OperationFilter<ServerVariablesOperationSecurityFilter>();

https://github.com/iOvergaard/umbraco-servervariables/blob/69e78747e24897341802d1b2a1d544ed320e24ce/src/ServerVariables/Composers/ApiComposer.cs#L45