Just noticed this issue today. Generating an api key for all users with global scopes, then updating a topic will result in an invalid_access curl --location --request PUT 'https://example.com/t/-/365.json' \ --header 'Api-User: system' \ --header 'Api-Key: ***' \ --header 'Content-Type: application/json' \ --data-raw '{ "tags": ["awesome-tag"] }' { "errors": [ "You are not permitted to view the requested resource. The API username or key is invalid." ], "error_type": "invalid_access" } However if you generate a global api key for the user system, it works: Same request , different key. curl --location --request PUT 'https://example.com/t/-/365.json' \ --header 'Api-User: system' \ --header 'Api-Key: DIFFERENT_KEY' \ --header 'Content-Type: application/json' \ --data-raw '{ "tags": ["awesome-tag"] }' { "basic_topic": { "id": 365, "title": "Test topic", "fancy_title": "Test topic", "slug": "test-topic", "posts_count": 6 } }

[תמונה] JustinBack: --header 'Api-User: system' This should be Api-Username, not Api-User This header is only used for “all user” api keys, so that’s why it worked when you scoped the key to a specific user.

גישה לא חוקית באמצעות Global Key על כל המשתמשים

מפתח

JustinBack (Justin René Back) 29 בנובמבר,‏ 2020,‏ 6:52pm 3

Ah alright, was that changed recently? As I had in mind that the header is Api-User

נושא		תגובות	צפיות
Generate/Regenerate api_key for a user API not working Development rest-api	4	1033	6 בדצמבר,‏ 2019
Issues using API with long-established/working key Product Support	2	445	20 באפריל,‏ 2022
Unable to edit topic via API despite topic write access Bug rest-api	4	821	4 במרץ,‏ 2022
Newly enforced api_username restriction? Development rest-api	4	654	29 באוקטובר,‏ 2020
404 when trying to create an API key for system user Bug	3	1381	11 באוגוסט,‏ 2020

גישה לא חוקית באמצעות Global Key על כל המשתמשים

נושאים קשורים