Authentication

[kdev]

Let's say I have a Service that tries to fetch some data or post to a restricted endpoint: How would I authenticate myself? It does not seem to be done with headers, so how is it done?

[PhlexPlexico]

Authentication for something like a bot is done through API Key auths. When a user is created, an API key is generated with it as well. You can view these through the /user/{userid} endpoint if you're a superadmin/logged into the right account. In order to reach a protected endpoint, you simply provide...user_api and user_id in the body of your request it will go through the authentication process of the following call:

G5API/utility/utils.js

Line 131 in e4cea78

static async ensureAuthenticated(req, res, next) {

Thanks! :)

[kdev]

I'm starting off with something rather easy: /servers

[PhlexPlexico]

Well if you're using JS/Node, you can just use the built-in HTTP library to make a request. Something like this should be possible without the use of external libraries. That being said, I think there was a way that discord bots were grabbing information for servers, but maybe it was only publically available things, such as the name.

[kdev]

That seems to be quite the workaround tbh.
And it seems that I'm not able to get it to work when using TypeScript.
A neat solution would be to allow for passing the user_api and user_id values using headers

[kdev]

I searched the internet for a good workaround and found out that you generally should ignore the body in GET requests as it's not compliant with RFC and IETF standarts (links: 1; 2)

[PhlexPlexico]

TBH I wasn't exactly reading RFC compliance when initially making this and didn't think through the whole get commands, since I was more focused on security through modifying the data 😅 pull requests would be welcome to modify the ensureAuthenticated function to check the header for the user_id and api key respectively. I don't exactly have the time/capacity due to other projects and life unfortunately, however this seems to be an easy enough change as well!