where is the api docs for nodebb?

[creatxr]

i write code like it's in the test .js below:

---

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request.post('https://localhost/login',{
			form: {
				username: name,
				password: pass
			},
			json: true,
			jar: jar,
			rejectUnauthorized: false,
			requestCert: true,
			agent: false,
			headers: {
			}
		});
	console.log(res.body);
}

loginNodeBB('creatxr','creatxr');

---

console message is:

username=creatxr&password=creatxr

it doesn't get the info if the user is authenticated or not !

[creatxr]

@julian

if i do like this

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request.post('https://172.16.220.133/login',{
			form: {
				username: name,
				password: pass
			},
			json: true,
			jar: jar,
			rejectUnauthorized: false,
			requestCert: true,
			agent: false,
			headers: {
			}
		},
			function (err, response, body) {
				console.log(body);
				console.log('1111111111111');
			}
		);
	console.log(res.body);
}

output is:

username=creatxr&password=creatxr
Forbidden
1111111111111

[julian]

Looks like you're not passing CSRF token in. You can get it by checking config.csrf_token on client side. Pass it in under x-csrf-token header.

[creatxr]

@julian

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request({
		url: 'https://172.16.220.133/api/config',
		json: true,
		jar: jar,
		rejectUnauthorized: false,
			requestCert: true,
			agent: false,
	}, function(err,res,body) {
		if(err) {
			console.log(err);
		}
console.log('11111111111111');
		request.post('https://172.16.220.133/login', {
				form: {
					username: name,
					password: pass,
				},
				json: true,
				jar: jar,
				rejectUnauthorized: false,
			requestCert: true,
			agent: false,
				headers: {
					'x-csrf-token': body.csrf_token,
				},
			}, function (err, res, body) {
				//callback(err, response, body, jar);
				console.log(err);
	//			console.log(res);
	//			console.log(jar);
			});
	}

	);
}

now i change like this,
even username or password is wrong,
the err always is 'null'
how can i know authentication is passed?

[PitaJ]

@creatxr res.statusCode

[creatxr]

@PitaJ

thanks.

if success, code is 200 ? i think i get it.
if not , code is 403 ? or maybe has others.

[yariplus]

Not to be picky, but request is not a Promise. async is doing nothing.

[creatxr]

@yariplus

yes, i know. i've tried. console print before data return.

i just want to know how the auth works, then to find the way to do what i want.

thanks

[creatxr]

it seems that 'jar' option is required. without it, even with csrf token, the reponse is '403 err'

[creatxr]

This post is deleted!

[creatxr]

This post is deleted!

[creatxr]

now the code below with axios is success.

const axiosCookieJarSupport = require('axios-cookiejar-support').default;
const tough = require('tough-cookie');
axiosCookieJarSupport(axios);
async function authNodeBB(name,pass) {
	let cookieJar = new tough.CookieJar();

	let instance = await axios.create({
		jar:cookieJar,
		withCredentials: true,
		httpsAgent: new https.Agent({ rejectUnauthorized: false, requestCert: true, keepAlive: true})
	});
	let res = await instance.get('https://172.16.220.133/api/config');
	console.log(res.data.csrf_token);

	instance.defaults.headers['x-csrf-token'] = res.data.csrf_token;

	res = await instance.post('https://172.16.220.133/login',{username:name,password:pass});

	console.log(res.statusCode);
	console.log(res);
}

[creatxr]

the code with promised request is success

async function authBB(name,pass) {
	let jar = requestPromise.jar();
	let res = await requestPromise({
					url: 'https://172.16.220.133/api/config',
					json: true,
					jar: jar,
					rejectUnauthorized: false,
					requestCert: true,
					agent: false,
				});
	console.log(res.csrf_token);



	res = await requestPromise.post('https://172.16.220.133/login', {
				form: {
					username: name,
					password: pass,
				},
				json: true,
				jar: jar,
				rejectUnauthorized: false,
				requestCert: true,
				agent: false,
				headers: {
					'x-csrf-token': res.csrf_token,
				},
	//			resolveWithFullResponse: true
			});

	console.log(res.header.user);
	console.log(res);
	console.log(res.statusCode);
}

[creatxr]

the code with python is success

#coding=utf-8

import requests

client = requests.session()
csrf = client.get(url='https://172.16.220.133/api/config', verify=False).json()["csrf_token"]

print csrf

r = client.post(url='https://172.16.220.133/login', verify=False, data={'username':'creatxr', 'password':'creatxr'}, headers={'x-csrf-token': csrf})
print r.content

[julian]

Glad to hear it

[aneeeshp]

@creatxr @julian Just tried this code, but, 'csrf_token' value is false. uid value is -1.

Tried the same query from a web browser, this time there is a csrf_token token returned and uid value is 0.

Why is this difference? How to avoid this in the python code?

[baris]

If you are getting uid===-1 on the /api/config route it means your request was classified as a spider. https://github.com/NodeBB/NodeBB/blob/master/src/routes/authentication.js#L38