Problem on using the api

SteveXu200512

here is the code python3

import requests

data = {"Token": "my api key", "userId": "1"}
res=requests.post("https://www.mcwmstudio.club/api/token", data=data)
print(res.json())

it return

{
  'errors': [
    {
      'status': '400',
      'code': 'csrf_token_mismatch'
    }
  ]
}

I have that API key in the database with the same userId, did I insert the API key in a wrong way?
https://easyupload.io/ud5ndw
the one without a name in the pic is "scope"

askvortsov

The team is aware of this issue, and a fix is planned for the beta 13 release. Please see flarum/core1905 for more info on progress. In the meantime, you could use Beta 12's middleware extender (after beta 12 is released) to exempt that route from CSRF validation.

SteveXu200512

askvortsov Is that mean I can't do anything with using the API right now?

clarkwinkelmann

SteveXu200512 if you pass an API Key in the headers, I believe all endpoints work fine without any CSRF header.

The issue with POST /token is that you currently must call it with either an API Key or a CSRF token, the latter being impractical in a script situation.

I don't know which request library you are using but the way you send the API key doesn't look right. It must be passed in an Authorization header and ;userId=1 must be added in the same header line after the key.

SteveXu200512

clarkwinkelmann

import requests
a = (('Token', 'token'), ('userId', '1'))

res = requests.post("https://www.yourdomain.com/api/token", auth=a)
print(res.json())

It still gives me a status 400

clarkwinkelmann

SteveXu200512 are you "Most Patient Guy" on Discord ? I just want to check so that we don't reply in two different threads for the same issue.

SteveXu200512

clarkwinkelmann yes I am the most “patient” guy

clarkwinkelmann

SteveXu200512 okay so we can continue on either Discord or here.

Anyway the header's supposed to be

Authorization: Token <thetoken>; userId=<theid>

Example

Authorization: Token abcdef; userId=1

And it's a header, not an auth username/password. I'm not sure how those are passed in Python, but auth doesn't sound like the correct parameter for headers.

SteveXu200512

clarkwinkelmann it works but it returns
{'errors': [{'status': '401', 'code': 'not_authenticated'}]}
what should i do authenticated it

SteveXu200512

Finally works, thanks clarkwinkelmann
More questions
Are there are API for people to check the password for uesrs?
https://www.yourdomain.com/api/check_password???

clarkwinkelmann

SteveXu200512 Are there are API for people to check the password for uesrs?

Not really. What are you trying to achieve ?

SteveXu200512

clarkwinkelmann A Minecraft server plugin to auth player, make sure there acc not get hacked

i use flaring as my server’s discussion website

clarkwinkelmann

SteveXu200512 there is the login endpoint of the forum, but using it would create unnecessary sessions.

The best would be to create your own API endpoint via an extension for that check. If you're going for your own Flarum extension, I would even suggest not relying on passwords but instead maybe show a one-time token on the forum which they can paste in Minecraft. Or a link in Minecraft with a token that they can open in their browser to check they are connected to Flarum. That would prevent any risk of exposing the forum password through Minecraft.

SteveXu200512

clarkwinkelmann That is a really good idea, I want to use that before, but sadly I don’t know how to make flarum extension, that’s why I am asking api