I have a question more about the security of using the API because I think I’m missing some trivial concept with my lack of experience. I have a headless implementation of discourse to integrate into my frontend and I’ve successfully enabled sso for user authentication. My initial understanding wa…

[图片] BrainFried: a headless implementation of discourse to integrate into my frontend [图片] BrainFried: isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? An Admin API key is the key to the kingdom [图片] Do not put it a…

[图片] BrainFried: If my understanding is correct, isn’t this easy for a hacker to just modify the api-username in the header to retrieve chat discussions for any user? You should never use that API from a frontend because in that case this indeed is a risk (actually the risk is much higher bec…

As a headless implementation, I will be running this from my front end. So, in this case it seems like I need spend some time trying to decipher the discussion on this topic then: [图片] User API keys specification Integrations Discourse contains a system for ge…

关于 API 认证用户的混淆

开发

supermathie (Michael Brown) 2024 年5 月 31 日 02:57 2

管理员 API 密钥是通往王国的钥匙

不要将其放在任何前端应用程序中。如果你这样做了，我建议你立即撤销它。

话题		回复	浏览量
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	656	2023 年6 月 26 日
Create apikey for user programmatically as admin Development rest-api	8	2150	2024 年2 月 26 日
Allow API use by regular users, not just admins Development rest-api	6	1565	2023 年2 月 14 日
Work with discourse users on an SPA Development	2	1289	2022 年1 月 13 日
The purpose of the 2 Discourse API systems Support	5	1533	2020 年6 月 24 日

关于 API 认证用户的混淆

相关话题