I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding was that I was using SSO to authenticate as the “activeUser” to fetch activeUser-specific data from the api. I see now, that’s not entirely correct. I see now that the data that is returned seems to be dependent on the ‘api-username’ passed into the header. But I’m using an Admin API key so I believe this means that I can fetch any user’s data that I want by passing the correct username for “api-username”. So my question boils down to, It’s seems like the API doesn’t introduce a concept of “activeuser” and I have to adjust the active user by retrieving the username by external_id then using that as the api-username throughout the active session, is that correct? If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? Any additional information will be appreciated to help me understand. Thanks! Some related articles that I’ve read: [תמונה] User API keys specification Integrations Discourse contains a system for generating API keys per user if a very specific protocol is followed. This feature facilitates “application” access to Discourse instances without needing to involve moderators. High level description At a high level: Client (desktop app, browser plugin, mobile app) generates a private/public key pair and return url Client redirects to a route on discourse giving discourse its public key Discourse gets approval from user to use app Discourse generat… [תמונה] Get notifications via the API Integrations If you have an existing website or application and you would like to encourage discussion on your Discourse forum it can be helpful to display Discourse notifications inside of your application. This guide will show you how to use the Discourse API to fetch notifications for a user and how to mark them as read. The recommended way of using the API is to have your application make back-end requests to Discourse and then pass that data to the front-end/presentation layer of your application. Che… [תמונה] Using Discourse API to return user data when the "Require authentication to read content on this site, disallow anonymous access." setting is checked Bug Hi, I enabled the setting “Require authentication to read content on this site, disallow anonymous access”. I’m making a GET request to the /users/by-external/{EXTERNAL_ID}.json endpoint, and without the above setting enabled, it returns a user perfectly fine. But when I enable the above setting, the GET request returns nothing. For reference, I have SSO enabled. Let me know if there’s a workaround or if I’m thinking about this incorrectly. Thanks in advance! [תמונה] Per User API Keys Not Working Support I’m following the guidance for getting per user api keys: User API keys specification. I’ve gone through the steps: client generates a public/private key pair and return url, goes to a discourse route, user gives approval to discourse to use the app, and discourse generates an api key. But when discourse sends back the API key as a “payload” in the return url, that key doesn’t work. I try to decrypt it, but I can’t. I plug that key into some standard javascript decryption (like in the answer h…

[תמונה] BrainFried: a headless implementation of discourse to integrate into my frontend [תמונה] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [תמונה] Do not put it anywhere in a frontend app. If you did, I recommend you revoke it immediately.

[תמונה] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher because the hacker can do anything) You should do this from the backend. If that is not an option then you should use User API keys instead.

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [תמונה] User API keys specification Integrations Discourse contains a system for generating API keys per user if a very specific protocol is followed. This feature facilitates “application” access to Discourse instances without needing to involve moderators. High level description At a high level: Client (desktop app, browser plugin, mobile app) generates a private/public key pair and return url Client redirects to a route on discourse giving discourse its public key Discourse gets approval from user to use app Discourse generat… Similar to these discussions, I would be interested in auto-generating the users api-key using my admin api access However, in my flow, I wouldn’t want the user to redirect to a new page to “approve” my app. I will either want to force approval using my trusty admin api key or is there a setting that I can disable so that additional authentication is not needed for the new user-api-key that I generate?

בלבול בנוגע ל-API משתמש מאומת

מפתח

supermathie (Michael Brown) 31 במאי,‏ 2024,‏ 2:57am 2

An Admin API key is the key to the kingdom

Do not put it anywhere in a frontend app. If you did, I recommend you revoke it immediately.

נושא		תגובות	צפיות
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	680	26 ביוני,‏ 2023
Create apikey for user programmatically as admin Development rest-api	8	2273	26 בפברואר,‏ 2024
Allow API use by regular users, not just admins Development rest-api	6	1675	14 בפברואר,‏ 2023
Work with discourse users on an SPA Development	2	1308	13 בינואר,‏ 2022
The purpose of the 2 Discourse API systems Product Support	5	1562	24 ביוני,‏ 2020

בלבול בנוגע ל-API משתמש מאומת

נושאים קשורים