More HTTP API

SteveXu200512

More HTTP API
For example password check, ban check, upload ban, upload nickname,

clarkwinkelmann

SteveXu200512 ban check, upload ban, upload nickname

If you are referring to the features implemented by the existing extensions, they each use the HTTP API for that.

The extension authors have most likely not documented those endpoints are they are designed to be used internally, but usually you're able to re-use them.

SteveXu200512 password check

This doesn't make sense as part of the core software and could even be a security risk. A third-party extension can add that if needed.

askvortsov

SteveXu200512 What is the use case for checking if a users password is correct over an HTTP api?

SteveXu200512

clarkwinkelmann
I don't think there are any extension have more api

clarkwinkelmann

askvortsov this was discussed previously in https://discuss.flarum.org/d/22956-problem-on-using-the-api/11

SteveXu200512

askvortsov For example, use flarum as community of a software, people can sync the username and password.

askvortsov

SteveXu200512 I would recommend against syncing accounts through using the same username/password on both services. There's a lot of SSO systems (e.g. OAuth, SAML, custom SSO) designed to share identity across multiple sites, I'd recommend looking into those.

SteveXu200512

askvortsov Is that means i can use oAuth to check passwords?

askvortsov

SteveXu200512 no, but that's actusllt kind of the point. See https://developer.okta.com/blog/2017/06/21/what-the-heck-is-oauth, for example

SteveXu200512

askvortsov But what I want is to check the password, I need the password because I need to make sure that the account owner is using it.

xxsuperdreamxx

SteveXu200512 I hope you have heard of GDPR, because this is violating any kind of privacy of the users, you have billion ways of verifying if this is the real person. Like code confirmation through email, but looking at other people's passwords is just wrong what if they use the same password everywhere.