I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding wa…

[صورة] BrainFried: a headless implementation of discourse to integrate into my frontend [صورة] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [صورة] Do not pu…

[صورة] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher b…

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [صورة] User API keys specification Integrations Discourse contains a system for …

ارتباك حول مستخدم API المصادق عليه

مطور

supermathie (Michael Brown) 31 مايو 2024، 2:57ص 2

مفتاح واجهة برمجة تطبيقات المسؤول هو مفتاح المملكة

لا تضعه في أي مكان في تطبيق الواجهة الأمامية. إذا فعلت ذلك، أوصي بإلغائه على الفور.

الموضوع		الردود	مرات العرض
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	656	26 يونيو 2023
Create apikey for user programmatically as admin Development rest-api	8	2150	26 فبراير 2024
Allow API use by regular users, not just admins Development rest-api	6	1565	14 فبراير 2023
Work with discourse users on an SPA Development	2	1289	13 يناير 2022
The purpose of the 2 Discourse API systems Support	5	1533	24 يونيو 2020

ارتباك حول مستخدم API المصادق عليه

الموضوعات ذات الصلة