Hello. I need to display password protected Discourse feed on the external site. How to do that? Other sites suggest using this structure http://[username]:[password]@[domain]/[path] But for Discourse it doesn’t work. By the way, the external site that I want to show the feed is a wordpress page. Discourse is linked to this page with SSO. Any ideas?

I assume you mean RSS feeds. You can generate an API key for a user account on your site in the admin section. Then you can just append it to any URL like so: http://meta.discourse.org/latest.rss?api_key=KEYHERE I should note there are security issues with making that api key visible to users. If someone has it, they can do anything that the underlying user account can do. It would be much better to fetch the RSS server side using the key then only exposing the resulting feed. Also, be especially careful not to generate an “All Users” key for this. If someone gets that key they can do anything as any user on your site. So just be extra careful :smile:

Great answer, eviltrout. Thank you very much :smile:

We are having the issue that the RSS feeds do not work with an api_key if the categories have read restrictions, even if the api_key is valid for a user that should be able to access the category. Is this a bug or by design?

[image] dansingerman: Is this a bug or by design? That sounds like a bug to me. The API key should function as the user associated with it. Are you passing the correct username through too?

No, I’m not passing a username, as I am using a key associated with a user. If I try in an unauthenticated session: http://myserver.example.com/latest.json?api_key=my_api_key I get the results I expect If I try http://myserver.example.com/latest.rss?api_key=my_api_key I get no results. So unless RSS has some special case of how to use API keys, I think it may be a bug

This was a bug, now fixed via: https://github.com/discourse/discourse/commit/f50d4478810a0d5616ba06448dcae51aaeccb192

With the new fix, I am able to view restricted categories in the RSS feed at … http://myserver.example.com/c/my_category.rss?api_key=my_api_key but Latest only shows public topics in the RSS feed http://myserver.example.com/latest.rss?api_key=my_api_key Is this still unresolved or am I missing something? Thanks.

Yes they do! @blake any thoughts about how people will do private RSS feeds in the current world. Do browsers/rss feed things support custom headers for auth? This is a pretty rare use case, but would be nice if we had a workaround.

The only auth related thing to rss is support for url based basic auth like https://user:password@www.example.com (which we don’t have support for) or something like what we currently support with api_key & api_username in the url. While it would have been nice to completely retire url based auth I think the way forward so that we still have support for private rss is to only allow this type of auth for topic/category feeds, and then later we can also add support for readonly api keys. The problem is also that rss readers usually only have a single url field for adding a feed, so even if rss had support for headers, readers don’t have a place to add credentials to a header.

How to get a feed from a password protected Discourse?

Development

codinghorror (Jeff Atwood) January 2, 2020, 1:48am 10

Don’t api keys need to be in the headers now @sam?

Topic		Replies	Views
Valid users get empty RSS for restricted categories Bug rss	9	1942	July 21, 2022
Creating an API key for RSS reader due to login required? Product Support	2	1360	August 29, 2017
Not public RSS Feed? Product Support rss	4	352	January 27, 2025
Latest topics RSS feed for private site? Product Support	6	1919	August 16, 2015
Finding Discourse RSS feeds Using Discourse rss , reference	25	11650	January 18, 2025

How to get a feed from a password protected Discourse?

Related topics