Jump to content

Bug found in RESP API


thaivisa
 Share

Recommended Posts

While the REST API guide state that you can use the "key" parameter, there's actually nothing in the code to look for it, unless you run it from CGI (as of 4.1.16).
You need to send a HTTP Basic Authorization header

$('#action-button').click(function() {
	$.ajax({
		url: 'http://csip.thaivisa.com/api/core/hello',
		beforeSend: function( xhr ) 
		{
			xhr.setRequestHeader( "Authorization", "Basic " + window.btoa( unescape( encodeURIComponent( 'exxxxxxxxxxxxxxxxxxxxxxxxe' ) ) ) );
		},
		success: function( data )
		{
			Debug.log( data );
		}
	});
});
Link to comment
Share on other sites

Response from IPS Support:

Quote

Yes, this is actually intentional - the problem is that some servers, when configured in CGI mode, do not support HTTP Authorization properly. In those instances, then the "key" parameter can be used. This, however, is less secure and has the chance to expose the API key which then opens the API up to abuse, if obtained.

The API itself is not really designed to be used via AJAX - further, doing what you are doing will also expose the API key to those who should not have it. What I would recommend doing, in this instance, is point the AJAX call to a PHP file locally, and then have that PHP file perform the API request and return the results.

 

Link to comment
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...