I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding wa…

[image] BrainFried: a headless implementation of discourse to integrate into my frontend [image] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [image] Do not…

[image] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher …

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [image] User API keys specification Integrations Discourse contains a system for…

Confusion concernant l'utilisateur authentifié de l'API

Dev

supermathie (Michael Brown) Mai 31, 2024, 2:57 2

Une clé API d’administrateur est la clé du royaume

Ne la mettez nulle part dans une application frontend. Si vous l’avez fait, je vous recommande de la révoquer immédiatement.

Sujet		Réponses	Vues
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	656	Juin 26, 2023
Create apikey for user programmatically as admin Development rest-api	8	2150	Février 26, 2024
Allow API use by regular users, not just admins Development rest-api	6	1565	Février 14, 2023
Work with discourse users on an SPA Development	2	1289	Janvier 13, 2022
The purpose of the 2 Discourse API systems Support	5	1533	Juin 24, 2020

Confusion concernant l'utilisateur authentifié de l'API

Sujets connexes