Getting API token and posting a new discuss with External Connection

BilgehanArslan

The issue

When i try to connect to api endpoint to create a token i get 403 error with "Access to this resource on the server is denied!" message. I think xsrf protection does this. Is there any way to post a new discussion with external connection? Do i need a write a extension for this?

clarkwinkelmann

BilgehanArslan can you share which endpoint(s) you used and how you formatted your JSON payload?

Creation of access tokens via the REST API is described at https://docs.flarum.org/rest-api#access-tokens

The /api/token endpoint should not have CSRF protection. If you try hitting another endpoint that has CSRF protection and don't pass a valid access token or API key you should receive an HTTP 400 error with csrf_token_mismatch in the JSON:API error payload.

The 403 error is probably related to something different than CSRF. I believe invalid credentials will throw a 401 error. So 403 must be a valid request but for something your current user is not allowed to do. Or maybe it's thrown by the webserver that doesn't correctly transfer the request to Flarum.

If this doesn't help, can you share the exact response body of the 403 error? Is it HTML or JSON? Can you try setting debug to true in config.php and try again to see if there's any difference in the error output?

BilgehanArslan

clarkwinkelmann

endpoint:

/api/discussions
created apikey without any problem now.

tried again

with this code:


import requests
import json

api_key = "API-key"

forum_url = "https://example.com/api/"

payload = {
    "data": {
        "type": "discussions",
        "attributes": {
            "title": "Başlık Adı",
            "content": "Başlık İçeriği"
        },
        "relationships": {
            "tags": {
                "data": [
                    {"type": "tags", "id": "1"} 
                ]
            }
        }
    }
}

headers = {
    'Content-Type': 'application/json',
    'Authorization': 'Token ' + api_key
}

response = requests.post(forum_url + 'discussions', headers=headers, data=json.dumps(payload))

if response.status_code == 200:
    print("Başlık başarıyla oluşturuldu.")
else:
    print("Başlık oluşturulamadı. Hata kodu:", response.status_code)
    print("Hata mesajı:", response.text)

response:

there is no difference, same.
i also disabled modsecurity


Başlık oluşturulamadı. Hata kodu: 403
Hata mesajı: <!DOCTYPE html>
<html style="height:100%">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<title> 403 Forbidden
</title></head>
<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">
<div style="height:auto; min-height:100%; ">     <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">
        <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">403</h1>
<h2 style="margin-top:20px;font-size: 30px;">Forbidden
</h2>
<p>Access to this resource on the server is denied!</p>
</div></div></body></html>

clarkwinkelmann

BilgehanArslan it's probably Flarum or an extension that's not happy with the information provided in the JSON payload. Is the user allowed to post in that tag? Are they allowed to select just one tag? Are you running any extension that might add additional fields or captcha to the discussion composer ?

BilgehanArslan

clarkwinkelmann Actually i tried to post a discussion to blog extension’s tag. Maybe its about that, I will try it again tommorow.

And also, thats the main point, if i want to post a blog which data i must to change in json payload.

clarkwinkelmann

BilgehanArslan try creating a discussion (blog) from the browser and use the browser development tool to inspect the JSON it sends.

It's very likely the Blog extension adds additional attributes to that request. They might not all be required but maybe that's what triggers the 403 error.

Unfortunately Flarum doesn't make it very easy to know which extension or feature is throwing a permission (403) error.

If you can copy a valid payload from the browser network tab, you can then remove attributes you think should be optional until the error happens again. Then you'll know it was the last attribute you removed that was in fact causing the error by being missing.

If you really can't figure it out my Gate Logger extension might help troubleshoot this but it's not the easiest extension to use 😅 https://discuss.flarum.org/d/29351-gate-logger-for-developpers

BilgehanArslan

clarkwinkelmann
i solved my problem thanks for your kindness <3

The problem was the headers.

Here a python code for to get a api token.


import requests
import json

Data = {
    'identification': 'USER',
    'password': 'PASS'
}
newHeaders = {'Content-type': 'application/json',     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/80.0.3987.163 Safari/537.36 "}
r = requests.post("https://EXAMPLE.COM/api/token", data=json.dumps(Data), headers=newHeaders)
print(f"Status Code: {r.status_code}, Response: {r.text}")
print(json.dumps(Data))

and also that code for the send a discussion:

import requests
import json

# Change APIKEY to the key that u have
api_key = "APIKEY"

# Change example.com to your site
forum_url = "https://EXAMPLE.COM/api/"

# In this part edit xxxTITLExxx and xxxCONTENTxxx 
payload = {
    "data": {
        "type": "discussions",
        "attributes": {
            "title": "xxxTITLExxx",
            "content": "xxxCONTENTxxx"
        },
        "relationships": {
            "tags": {
                "data": [
                    {"type": "tags", "id": "2"}  # Example, 'General' tag's ID
                ]
            }
        }
    }
}

headers = {
    "Content-Type": "application/json",
    "Authorization": "Token " + api_key,
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) "
    "Chrome/80.0.3987.163 Safari/537.36 "
}

# POST isteğini oluştur ve gönder
response = requests.post(forum_url + 'discussions', headers=headers, data=json.dumps(payload))

# Yanıtı kontrol et
if response.status_code == 201:
    print("Succesfully posted.")
else:
    print("ERROR CODE:", response.status_code)
    print("ERROR MESSAGE:", response.text)