Jump to content

Bug found in RESP API


Recommended Posts

While the REST API guide state that you can use the "key" parameter, there's actually nothing in the code to look for it, unless you run it from CGI (as of 4.1.16).
You need to send a HTTP Basic Authorization header

$('#action-button').click(function() {
		url: 'http://csip.thaivisa.com/api/core/hello',
		beforeSend: function( xhr ) 
			xhr.setRequestHeader( "Authorization", "Basic " + window.btoa( unescape( encodeURIComponent( 'exxxxxxxxxxxxxxxxxxxxxxxxe' ) ) ) );
		success: function( data )
			Debug.log( data );
Link to comment
Share on other sites

Response from IPS Support:


Yes, this is actually intentional - the problem is that some servers, when configured in CGI mode, do not support HTTP Authorization properly. In those instances, then the "key" parameter can be used. This, however, is less secure and has the chance to expose the API key which then opens the API up to abuse, if obtained.

The API itself is not really designed to be used via AJAX - further, doing what you are doing will also expose the API key to those who should not have it. What I would recommend doing, in this instance, is point the AJAX call to a PHP file locally, and then have that PHP file perform the API request and return the results.


Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...