get api key from http header only

Author: Christian Cordiviola

www/addresses.php

@@ -5,7 +5,8 @@
 // found in the LICENSE.md file.
 require_once __DIR__ . '/common.inc';
 
-if (isset($_REQUEST['k'])) {
+$user_api_key = $request_context->getApiKeyInUse();
+if (strlen($user_api_key)) {
     $keys_file = SETTINGS_PATH . '/keys.ini';
     if (file_exists(SETTINGS_PATH . '/common/keys.ini')) {
         $keys_file = SETTINGS_PATH . '/common/keys.ini';
@@ -14,7 +15,7 @@
         $keys_file = SETTINGS_PATH . '/server/keys.ini';
     }
     $keys = parse_ini_file($keys_file, true);
-    if (isset($keys['server']['key']) && $_REQUEST['k'] == $keys['server']['key']) {
+    if (isset($keys['server']['key']) && $user_api_key == $keys['server']['key']) {
         $admin = true;
     }
 }

www/getLocations.php

@@ -201,7 +201,8 @@ function LoadLocations($isPaid = false)
     $isPaid = false;
     $locations = array();
     $loc = LoadLocationsIni();
-    if (isset($_REQUEST['k'])) {
+    $user_api_key = $request_context->getApiKeyInUse();
+    if (strlen($user_api_key)) {
         foreach ($loc as $name => $location) {
             if (isset($location['browser']) && isset($location['noapi'])) {
                 unset($loc[$name]);

www/getTesters.php

@@ -8,7 +8,8 @@
     //header("HTTP/1.1 403 Unauthorized");
     //exit;
 }
-if (isset($_REQUEST['k'])) {
+$user_api_key = $request_context->getApiKeyInUse();
+if (strlen($user_api_key)) {
     $keys_file = SETTINGS_PATH . '/keys.ini';
     if (file_exists(SETTINGS_PATH . '/common/keys.ini')) {
         $keys_file = SETTINGS_PATH . '/common/keys.ini';
@@ -17,7 +18,7 @@
         $keys_file = SETTINGS_PATH . '/server/keys.ini';
     }
     $keys = parse_ini_file($keys_file, true);
-    if (isset($keys['server']['key']) && $_REQUEST['k'] == $keys['server']['key']) {
+    if (isset($keys['server']['key']) && $user_api_key == $keys['server']['key']) {
         $admin = true;
     }
 }

www/src/RequestContext.php

@@ -131,7 +131,7 @@ public function getHost(): string
 
     public function setEnvironment(?string $env = ''): void
     {
-      // This should really be a match, but we're on 7.4
+        // This should really be a match, but we're on 7.4
         switch ($env) {
             case 'development':
                 $this->environment = Environment::$Development;
@@ -161,21 +161,17 @@ public function getEnvironment(): string
     public function getApiKeyInUse(): string
     {
         if (empty($this->api_key_in_use)) {
-            $user_api_key = $this->getRaw()['k'] ?? "";
-            if (empty($user_api_key)) {
-                $user_api_key_header = $this->user_api_key_header;
-                $request_headers = getallheaders();
-                $matching_headers = array_filter($request_headers, function ($k) use ($user_api_key_header) {
-                    return strtolower($k) == strtolower($user_api_key_header);
-                }, ARRAY_FILTER_USE_KEY);
-                if (!empty($matching_headers)) {
-                    $user_api_key = array_values($matching_headers)[0];
-                }
+            $user_api_key_header = $this->user_api_key_header;
+            $request_headers = getallheaders();
+            $matching_headers = array_filter($request_headers, function ($k) use ($user_api_key_header) {
+                return strtolower($k) == strtolower($user_api_key_header);
+            }, ARRAY_FILTER_USE_KEY);
+            if (!empty($matching_headers)) {
+                $user_api_key = array_values($matching_headers)[0];
             }
-
-            $this->api_key_in_use = $user_api_key;
+            $this->api_key_in_use = $user_api_key ?? "";
         }
 
-        return $this->api_key_in_use;
+        return $this->api_key_in_use ?? "";
     }
 }

www/usage.php

@@ -26,8 +26,9 @@
 ?>
 
 <?php
-if (array_key_exists('k', $_REQUEST) && strlen($_REQUEST['k'])) {
-    $key = trim($_REQUEST['k']);
+$user_api_key = $request_context->getApiKeyInUse();
+if (strlen($user_api_key)) {
+    $key = trim($user_api_key);
     $keys_file = SETTINGS_PATH . '/keys.ini';
     if (file_exists(SETTINGS_PATH . '/common/keys.ini')) {
         $keys_file = SETTINGS_PATH . '/common/keys.ini';