For our application, we use a global API key to be used with all users. We were using a virtual username (non-existent user) anonymous to represent the context when a user was not signed in. This worked for the last 3+ years until 10/25/2020 @ 12:39am CT. I mitigated this today by creating a user w…

Here’s the error… [Log Search 2020-10-26 10-59-01]

I’m not aware of a recent change that would have changed this behavior. I was under the impression it always worked like this (displaying an error if the user cannot be found). This is the code that checks if it can read the username from the api credentials [image] And the user below will be nil …

If it’s a public site, then you should be able to make these requests from your backend with no authentication at all to get the anonymous view. If rate limits become a problem, then yes you’ll need to use an actual dummy user.

One other thing I just thought about is the revoke api keys days site setting. Because that user doesn’t exist, we never update the last used date for that key and I bet the key was auto revoked? I’m still not sure how you would have been able to make valid request in the first place though.

최근 적용된 api_username 제한?

개발

riking (Kane York) 10월 29, 2020, 12:21오후 4

공개 사이트라면, 백엔드에서 인증 없이 요청을 보내 익명 뷰를 가져올 수 있어야 합니다. 속도 제한(rate limit)이 문제가 된다면, 실제로 더미 유저를 사용해야 합니다.

글		댓글	조회수
API endpoint users/by-external/ failing with authorization headers, works without Bug rest-api	2	659	6월 26, 2023
Passing an api_username for a user that does not exist returns a 500 with no useful context Development	9	2225	8월 2, 2016
Invalid Access using Global Key on All users Development rest-api	2	989	11월 29, 2020
User API access not working Support discourse-hub	2	137	12월 17, 2025
Issues using API with long-established/working key Support	2	430	4월 20, 2022

최근 적용된 api_username 제한?

Related topics