where is the api docs for nodebb?

creatxr

i want to know how to post to nodebb/login for authentication
and what's its response.

thanks.

julian

You can mimic a standard login by POSTing /login with username and password (and csrf token).

Otherwise, if you're looking to access protected user data via API, then you may want to look into Write API, which allows you to use bearer tokens to access user data.

creatxr

i write code like it's in the test .js below:

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request.post('https://localhost/login',{
			form: {
				username: name,
				password: pass
			},
			json: true,
			jar: jar,
			rejectUnauthorized: false,
			requestCert: true,
			agent: false,
			headers: {
			}
		});
	console.log(res.body);
}

loginNodeBB('creatxr','creatxr');

console message is:

username=creatxr&password=creatxr

it doesn't get the info if the user is authenticated or not !

creatxr

@julian

if i do like this

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request.post('https://172.16.220.133/login',{
			form: {
				username: name,
				password: pass
			},
			json: true,
			jar: jar,
			rejectUnauthorized: false,
			requestCert: true,
			agent: false,
			headers: {
			}
		},
			function (err, response, body) {
				console.log(body);
				console.log('1111111111111');
			}
		);
	console.log(res.body);
}

output is:

username=creatxr&password=creatxr
Forbidden
1111111111111

julian

Looks like you're not passing CSRF token in. You can get it by checking config.csrf_token on client side. Pass it in under x-csrf-token header.

creatxr

@julian

async function loginNodeBB(name,pass) {
	let jar = request.jar();
	let res = await request({
		url: 'https://172.16.220.133/api/config',
		json: true,
		jar: jar,
		rejectUnauthorized: false,
			requestCert: true,
			agent: false,
	}, function(err,res,body) {
		if(err) {
			console.log(err);
		}
console.log('11111111111111');
		request.post('https://172.16.220.133/login', {
				form: {
					username: name,
					password: pass,
				},
				json: true,
				jar: jar,
				rejectUnauthorized: false,
			requestCert: true,
			agent: false,
				headers: {
					'x-csrf-token': body.csrf_token,
				},
			}, function (err, res, body) {
				//callback(err, response, body, jar);
				console.log(err);
	//			console.log(res);
	//			console.log(jar);
			});
	}

	);
}

now i change like this,
even username or password is wrong,
the err always is 'null'
how can i know authentication is passed?

PitaJ

@creatxr res.statusCode

creatxr

@PitaJ

thanks.

if success, code is 200 ? i think i get it.
if not , code is 403 ? or maybe has others.

yariplus

Not to be picky, but request is not a Promise. async is doing nothing.

creatxr

@yariplus

yes, i know. i've tried. console print before data return.

i just want to know how the auth works, then to find the way to do what i want.

thanks

creatxr

it seems that 'jar' option is required. without it, even with csrf token, the reponse is '403 err'

creatxr

This post is deleted!

creatxr

This post is deleted!

creatxr

now the code below with axios is success.

const axiosCookieJarSupport = require('axios-cookiejar-support').default;
const tough = require('tough-cookie');
axiosCookieJarSupport(axios);
async function authNodeBB(name,pass) {
	let cookieJar = new tough.CookieJar();

	let instance = await axios.create({
		jar:cookieJar,
		withCredentials: true,
		httpsAgent: new https.Agent({ rejectUnauthorized: false, requestCert: true, keepAlive: true})
	});
	let res = await instance.get('https://172.16.220.133/api/config');
	console.log(res.data.csrf_token);

	instance.defaults.headers['x-csrf-token'] = res.data.csrf_token;

	res = await instance.post('https://172.16.220.133/login',{username:name,password:pass});

	console.log(res.statusCode);
	console.log(res);
}

creatxr

the code with promised request is success

async function authBB(name,pass) {
	let jar = requestPromise.jar();
	let res = await requestPromise({
					url: 'https://172.16.220.133/api/config',
					json: true,
					jar: jar,
					rejectUnauthorized: false,
					requestCert: true,
					agent: false,
				});
	console.log(res.csrf_token);



	res = await requestPromise.post('https://172.16.220.133/login', {
				form: {
					username: name,
					password: pass,
				},
				json: true,
				jar: jar,
				rejectUnauthorized: false,
				requestCert: true,
				agent: false,
				headers: {
					'x-csrf-token': res.csrf_token,
				},
	//			resolveWithFullResponse: true
			});

	console.log(res.header.user);
	console.log(res);
	console.log(res.statusCode);
}

creatxr

the code with python is success

#coding=utf-8

import requests

client = requests.session()
csrf = client.get(url='https://172.16.220.133/api/config', verify=False).json()["csrf_token"]

print csrf

r = client.post(url='https://172.16.220.133/login', verify=False, data={'username':'creatxr', 'password':'creatxr'}, headers={'x-csrf-token': csrf})
print r.content

julian

Glad to hear it

aneeeshp

@creatxr @julian Just tried this code, but, 'csrf_token' value is false. uid value is -1.

Tried the same query from a web browser, this time there is a csrf_token token returned and uid value is 0.

Why is this difference? How to avoid this in the python code?

<baris>

If you are getting uid===-1 on the /api/config route it means your request was classified as a spider. https://github.com/NodeBB/NodeBB/blob/master/src/routes/authentication.js#L38