Community

Using Write API with cookie auth

Locked Unsolved Technical Support
  • Mattias KlintM

    Hi

    I've managed to login to NodeBB via the API and I am using cookies to store the session.
    I can also read data from the API using this cookie to authenticate myself.

    But when I try to use the /api/v3/ write API functions to write stuff to NodeBB I get an error "Forbidden".
    If I use Bearer-authentication everything works ok.

    The documentation says cookie auth should be enough. But is this trure?

    OK: curl --request PUT -H "Authorization: Bearer 123456-b123-1234-1234-123123123123" --header 'Content-Type: application/json' --data '{"delta":1}' https://www.mynodebbthing.com/api/v3/posts/123/vote

    NOT OK: curl --request PUT --cookie "express.sid=s:kYz-N-SAiyq_DNtjPep6Msq3x2eEW_o.IXPlo3AaW5jxQCZ97G1rNvhjUU; Path=/; HttpOnly; Secure; SameSite=Lax" https://www.mynodebbthing.com/api/v3/posts/123/vote

    0
  • julianJ

    What do the server logs say?

    If your cookie authenticates properly my guess is you're not passing in a valid CSRF token. That is needed for cookie based authentication

    0
  • Mattias KlintM

    You were correct. I wasn't passing on a CSRF-token. Now everything works ok. The documentation about CSRF-tokens is very sketchy. It's documented in some places that you need tokens, but not in other places.

    From what I can find I can only get the CSRF-token from the /api/config endpoint. Are there other options?

    Also after working with this and finding basically no documentation on CSRF-tokens I am leaning on using bearer-auth to access the API instead. Which method is the most stable, bearer-auth or cookies?

    1
  • julianJ

    Correct, the only place to retrieve the csrf token is from the /api/config endpoint.

    Neither method is superior to the other. When we were building out the original api, we use cookie authentication as it was built in to the browser. With the advent of the write api, I added bearer token authentication to enable easier server-to-server communication.

    The read API is meant to be used with cookie authentication, the write API is meant to be used with bearer authentication, although both support both types.

    0
  • julianJ julian forked this topic on
  • Carlo LanciaC

    Can anyone send me a complete example of how to use the "csrf token" received by calling the /api/config endpoint?

    0
  • julianJ

    Please use the forked topic

    0
  • julianJ julian locked this topic on

Suggested Topics

  • H

    Problem installing following docs for mac osx install and using mongodb

    Technical Support
    0 Votes
    3 Posts
    215 Views
    H

    I was able to install it by following the instructions from here: https://products.containerize.com/discussion-forum/nodebb
    I already have node.js installed on my computer. I did not install redis or nginx.
    I have a mac, so on Terminal, after I created a directory called "nodebb", I skipped the first few lines of the instructions, and just pointed to the directory I created, by using the "cd" command. I then created another directory called NodeBB inside the nodebb directory. You may skip creating two directories and just create a directory called "NodeBB". I pointed to this directory by using the cd command.
    Then this line
    "git clone -b v1.15.x https://github.com/NodeBB/NodeBB.git ."
    was the key for me.
    After I typed that, nodebb was cloned to the directory.
    Then I ran "./nodebb setup".
    I used mongo for the database.
    When prompted, I pasted the connection string that I got from mongodb's site. I substituted "nodebb" for the database part in the string. (I set up mongodb (Cloud Atlas) beforehand). The instructions that come up on Terminal will tell you to call your database "nodebb".
    After that step, the program ran automatically and installed the files. It asked me to put in the username and password for mongodb and it also asked me to choose a name for admin and password. You might have to wait a while as it pauses for a long time after "Confirm Password". I thought there was some problem and was tempted to abort the operation, as it was taking a long time, but it did come up with further instructions after a while.
    I typed "./nodebb start" when the setup finished and then went to "localhost:4567", and this time, I was able to see a normal board, and could log in as admin.
    I write this follow-up in case another mac user has trouble installing nodebb. In the end, setup was pretty straightforward and did not involve a lot of steps. My OS is High Sierra.
    The instructions, including the ones for Linux, at the official nodebb site did not work for me.

  • venkATV

    Any api to get list of categories based on group

    Moved Technical Support
    0 Votes
    4 Posts
    373 Views
    PitaJP

    There's no ready made API for this, but you can try the following:

    const allCids = await Categories.getAllCidsFromSet('categories:cid'); const groupCids = await privileges.categories.filterCids('topics:create', allCids, 'groupName');
  • AzurepulseA

    What is the correct way to use Grunt?

    Technical Support
    1 Votes
    1 Posts
    134 Views
    AzurepulseA

    Hi,I'm new to nodeBB and I was trying to develop on Intellij.
    I simply add Configuration for Grunt using the default Grunt.js in the nodeBB folder.
    But I noticed something was different between running Grunt and running "nodebb --dev start".
    I wrote an empty plugin using "nodebb-plugin-quickstart". It works normal on "nodebb-dev-start".
    But,when I use Grunt to run it,it says "warn: [upgrade/appendPluginScripts] Unable to read plugin.json for plugin nodebb-plugin-fr-exam. Skipping." And all the sudden,the empty plugin I modified doesn't work anymore.No settings on ACP , no consoles on pages(I modified from nodebb-plugin-quickstart).
    What exactly did I do wrong?
    I'm pretty sure the dev group is using Grunt since the building process is annoying.There's no reason I can't use Grunt ,right?Please help.

  • G

    using loggedInUser in "/categories"

    Technical Support
    0 Votes
    2 Posts
    258 Views
    barisB

    Do this for the filter:categories.build hook as well

  • trevorT

    Using templates/partials, some examples, etc.

    Moved Technical Support
    3 Votes
    1 Posts
    1353 Views
    trevorT

    I believe you should have as many partials in your main template as efficiently as possible to cut down on redundant code. Here I'll write the standard for a good rule of thumb on how you should organize your templates and all the code within in them.

    Any redundant JS scripts should be in their own partial to be reused in other templates if need be.

    Take full advantage of the NBB API so that you extend your template even further. For example using <!-- IF loggedIn --> condition can greatly improve UX and conversions rates on your site. Having some type of call to action or banner within these will let the user know that they aren't logged. OR when they are logged in, show something else. You can come up with some pretty crafty ideas. But yeah, do what you can with the existing API.

    You can only do so much with the templates but is that good enough? Maybe, maybe not, but it does work when you plan out the logical flow and hopefully not get lost in the div's and such. For example on the Majestic Theme, the topic covers are pretty complex and one can easily get lost in the flow of what's going on. Here's a screenshot of the topics UI.

    Screen Shot 2015-03-17 at 8.12.29 AM.png

    Now lets take a little peek at whats under the hood;

    Screen Shot 2015-03-17 at 8.16.46 AM.png

    Screen Shot 2015-03-17 at 8.14.33 AM.png

    Now there's way more to this, but this is just a little example of how I control the topic covers. The only reason why I'm posting this is because I'm quite certain it would take a while to replicate without all of the other partials in this one template (not shown for obvious reasons).

    You can also do stuff like this to take control over pluralization of your template: post<!-- IF !topics.unreplied -->s<!-- ENDIF !topics.unreplied -->
    Which would mean, if you don't have any posts, remove the s in post, otherwise its posts. Neat huh?

    Anyone else have any cool things they've done with the template system so far in their existing theme? Share some of your ideas here. 🙂

Copyright © 2023 NodeBB | Contributors