I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding wa…

[이미지] BrainFried: a headless implementation of discourse to integrate into my frontend [이미지] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [이미지] Do not put i…

[이미지] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher be…

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [이미지] User API keys specification Integrations Discourse contains a system for g…

API 인증 사용자에 대한 혼란

개발

supermathie (Michael Brown) 5월 31, 2024, 2:57오전 2

관리자 API 키는 왕국의 열쇠입니다

프론트엔드 앱 어디에도 이를 노출하지 마세요. 이미 노출했다면 즉시 폐기하는 것을 권장합니다.

글		댓글	조회수
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	656	6월 26, 2023
Create apikey for user programmatically as admin Development rest-api	8	2150	2월 26, 2024
Allow API use by regular users, not just admins Development rest-api	6	1565	2월 14, 2023
Work with discourse users on an SPA Development	2	1289	1월 13, 2022
The purpose of the 2 Discourse API systems Support	5	1534	6월 24, 2020

API 인증 사용자에 대한 혼란

Related topics