We are using SSO for login and account creation. There’s no other way to login or signing up on our forum. However, the list of screened IPs has dozens of IP addresses which are being added automatically on a daily basis. Is this expected? What makes an IP address get added to the Screened IPs list…

The only way I can think of is when you delete an account and opt for the “delete spammer” button.

Good point — it’s when we remove an account through the API that the IP is being added to the Screened IPs. However, we are issuing the DELETE request using block_ip=false. This is from rails logs: Parameters: {"delete_posts"=>"1", "block_email"=>"0", "blocked_urls"=>"0", "block_ip"=>"0", "id"=>"1…

[图片] Can't SSO due to blocked IP addresses It sounds like you are calling the “delete as spammer” function, which will automatically blocklist the IP and email address. I think you should revisit that code. You want “plain delete” per the UI, not “delete as spammer”. That could be, although I …

You may want to use Reverse engineer the Discourse API and see exactly what requests are sent when you delete a user, and pressing the button that says Delete only [image] … because I can tell you for a fact that if you are seeing IPs get added to the screened list after deletion, you are absolut…

I had already done that and the deleting API endpoint is the one I have been using, which the same one for both actions (delete only and delete&block) — the only difference is on the parameters that are used with it (block_ip, block_email, …) that I mentioned aboved. [图片] mentalstring: However,…

I might have spoken too soon. :disappointed_face: Having corrected the truthy/falsy parameters to ‘true’/‘false’ strings, I still see entries being added to Screened IPs and Screened Emails upon deleting users. Here’s the rails logs for a API call: Started DELETE "/admin/users/9553.json" for 123.…

As long as you’ve emulated the behavior that you observe when you follow the Reverse engineer the Discourse API topic, you should be OK. What API calls are you observing in the network monitor when you push the “delete only” button?

In some cases, when the JS isn’t explicitly passing false to the server, the server treats any present value as true. This is likely what you’re encountering here.

SSO 和筛选的 IP 地址

支持 SSO

codinghorror (Jeff Atwood) 2021 年6 月 14 日 17:53 8

只要你模仿了在 Reverse engineer the Discourse API 主题中观察到的行为，就应该没问题。当你点击“仅删除”按钮时，在网络监控器中观察到了哪些 API 调用？

话题		回复	浏览量
How to delete user accounts via API without IP blocking SSO rest-api	10	326	2025 年5 月 15 日
Can't SSO due to blocked IP addresses SSO rest-api	7	2003	2021 年6 月 8 日
Does SSO make use of Screened IP Addresses to block registrations? SSO	7	931	2020 年9 月 29 日
BAD CSRF Response When Trying to Delete User by API Support	5	1018	2018 年8 月 1 日
Unable to log into my discourse - "You can't log in as xxx from that IP address." Support	5	3243	2015 年4 月 3 日

SSO 和筛选的 IP 地址

相关话题