# Using Discourse API to return user data when the "Require authentication to read content on this site, disallow anonymous access." setting is checked
**URL:** https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404
**Category:** Bug
**Tags:** rest-api
**Created:** [6. Mai 2015 um 22:11 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404 "2015-05-06T22:11:49Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@asko](https://meta.discourse.org/u/asko)
#### Post date: [6. Mai 2015 um 22:11 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/1 "2015-05-06T22:11:49Z")
Hi,
I enabled the setting “Require authentication to read content on this site, disallow anonymous access”.
I’m making a GET request to the /users/by-external/{EXTERNAL\_ID}.json endpoint, and without the above setting enabled, it returns a user perfectly fine. But when I enable the above setting, the GET request returns nothing.
For reference, I have SSO enabled.
Let me know if there’s a workaround or if I’m thinking about this incorrectly.
Thanks in advance!
---
### Author:  [@Eric\_Hoxworth](https://meta.discourse.org/u/Eric_Hoxworth)
#### Post date: [8. Mai 2015 um 16:15 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/2 "2015-05-08T16:15:30Z")
Also seeing this.
Without knowing how Discourse wants to handle this, it seems like an /admin/users/external/{EXTERNAL.ID}/log\_out function would be good to have so you could logout a user by their external ID.
(I’m not a ruby expert so I don’t feel comfortable submitting a pull request for this one)
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [9. Mai 2015 um 04:12 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/3 "2015-05-09T04:12:17Z")
You’ll need to authenticate/log in to make that request. One way to authenticate is to supply a `api_key` and `api_username`, which sounds like what you want here. (The other way is to store `Cookie`s.)
---
### Author:  [@asko](https://meta.discourse.org/u/asko)
#### Post date: [11. Mai 2015 um 14:44 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/4 "2015-05-11T14:44:16Z")
Thanks for getting back to me @riking. I’ve been authenticating for the log out call, since it’s a POST request so I can send the api\_key and api\_username in the request body. Since this call (/users/by-external/{EXTERNAL\_ID}.json) is a GET request, it doesn’t make sense to send those in the request body. I tried sending them as a header in the GET request but it wasn’t working. Does this sound like it might be a bug?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [11. Mai 2015 um 15:51 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/5 "2015-05-11T15:51:44Z")
Put them in as GET parameters. `?api_key=asfjkdla&api_username=system`.
---
### Author:  [@asko](https://meta.discourse.org/u/asko)
#### Post date: [11. Mai 2015 um 18:24 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/6 "2015-05-11T18:24:25Z")
Wouldn’t that be a security vulnerability?
[http://stackoverflow.com/questions/323200/is-an-https-query-string-secure](http://stackoverflow.com/questions/323200/is-an-https-query-string-secure)
[http://stackoverflow.com/questions/2629222/are-querystring-parameters-secure-in-https-http-ssl](http://stackoverflow.com/questions/2629222/are-querystring-parameters-secure-in-https-http-ssl)
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [11. Mai 2015 um 19:02 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/7 "2015-05-11T19:02:58Z")
If the request is submitted over HTTPS, the only logging occurs on the server-side, which knows the key anyways.
You can mitigate by creating a new admin user and generating an API key for them, then always using that as the username.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [11. August 2020 um 02:46 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/8 "2020-08-11T02:46:08Z")
Dies wird geschlossen. API-Anmeldedaten werden nun über HTTP-Header übergeben.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [11. August 2020 um 02:46 UTC](https://meta.discourse.org/t/using-discourse-api-to-return-user-data-when-the-require-authentication-to-read-content-on-this-site-disallow-anonymous-access-setting-is-checked/28404/9 "2020-08-11T02:46:11Z")