I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding wa…

[imagen] BrainFried: a headless implementation of discourse to integrate into my frontend [imagen] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [imagen] Do …

[imagen] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher…

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [imagen] User API keys specification Integrations Discourse contains a system fo…

Confusión sobre Usuario Autenticado de API

Desarrollador

supermathie (Michael Brown) 31 Mayo, 2024 02:57 2

Una clave de API de administrador es la clave del reino

No la pongas en ninguna parte de una aplicación frontend. Si lo hiciste, te recomiendo que la revoques inmediatamente.

Tema		Respuestas	Vistas
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	656	26 Junio 2023
Create apikey for user programmatically as admin Development rest-api	8	2150	26 Febrero 2024
Allow API use by regular users, not just admins Development rest-api	6	1565	14 Febrero 2023
Work with discourse users on an SPA Development	2	1289	13 Enero 2022
The purpose of the 2 Discourse API systems Support	5	1533	24 Junio 2020

Confusión sobre Usuario Autenticado de API

Temas relacionados