Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2.0.2 lost --apikey configuration and the abbility to specify an APIKEY via a file #6374

Open
Loki-Afro opened this issue May 10, 2024 · 5 comments · Fixed by #6382
Open

Comments

@Loki-Afro
Copy link

Describe the bug
2.0.2 lost --apikey configuration and the ability to specify an APIKEY via a file

some code references
fb56809#diff-56c1caaf7d4537bb927753753c7af805d5076ebf007dc4355eb47f570ea9fbe6L48
fb56809#diff-44bdd670b7e9c3a0511454a28c560903253342a74370d0a0d8556564ecc2c555L37
fb56809#diff-44bdd670b7e9c3a0511454a28c560903253342a74370d0a0d8556564ecc2c555L198

that is more than a breaking change while only changing the patch version!
based on the changelog it does introduce ADDITIONAL behavior rather then removing existing https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md#202

on top of that there are still references to the APIKEY file in code, mostly in utility scripts found in bin

making me think that the removal of the apikey logic was not done on purpose

if oauth is the only way forward, is there a migration strategy?

@SamTV12345
Copy link
Member

Thanks for the issue and sorry for my absense. As the APIKey option was not that difficult to add I'll readd support for that so you can choose between OAuth or API key. OAuth should be more secure as the key has a lifetime and you don't share the key with other people.

@disturbio
Copy link

Hello,

Is there a chance this might be incomplete?. When trying to perform a pad deletion through the API I get a no or wrong API Key (currently at commit 08ab3c0, development branch).

It seems it fails to pass this condition src/node/handler/APIHandler.ts

@dcht00
Copy link
Collaborator

dcht00 commented May 22, 2024

@SamTV12345 I'm also at last commit and not able to use the API anymore, though I have set
"authenticationMethod": "${AUTHENTICATION_METHOD:apikey}",

It seems from the log it's being loaded properly.
[2024-05-22T04:06:22.562] [INFO] APIHandler - Api key file read from: "#####/APIKEY.txt"

But all API calls give

no or wrong API Key

@dcht00 dcht00 reopened this May 22, 2024
@SamTV12345
Copy link
Member

I fixed authorization with authorization header. I guess you were only trying through that. The query parameter worked.

@dcht00
Copy link
Collaborator

dcht00 commented May 22, 2024

I think this still doesn't work:
curl "https://#####/api/1.2.13/deletePad?apikey=#####&padID=test2"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants