API call - Failed to load resource: net::ERR_NAME_NOT_RESOLVED

eeeee

I've been trying to use the API to make a post.
For testing purposes I put a function in the custom JS area to try this.

The docs didn't give a full payload example, so I made my best guess at the headers and where API key goes. This is what I tried


const bodyData={
"cid": 1,
"title": "Test topic",
"content": "This is the test topic's content",
"timestamp": 556084800000,
"tags": [
"test",
"topic"
]
}
const key='c562 ... ' // redacted
const option = {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    authorization: `Bearer `+key
  },
  body: JSON.stringify(bodyData)
};

 alert('Fetching API')
 fetch(
   'https://aignite.nodebb.org/api/v3/topics/', option
)
.then(response => response.json())
.then( data=> {alert("Api")} )
.catch(error => alert('err='+error) )

The alert fired, but no post was created and console error -
Failed to load resource: net::ERR_NAME_NOT_RESOLVED aignite.nodebb.org/api/v3/topics/:1

Can anyone advise, have I structured the API call incorrectly?

julian

Hi @eeeee, the URL of your hosted instance is aignite.nodebb.com, the .org tld is reserved for our own sites

eeeee

@julian Thanks, well spotted! I copied and pasted too far.

Well thats got me a step further, now API returns but with this
error
Unexpected token 'F', "Forbidden" is not valid JSON

julian

Right. POST requests are CSRF protected. Pass in the token in the headers object:

{
  ...
  'x-csrf-token': config.csrf_token,
  ...
}

eeeee

@julian said in API call - Failed to load resource: net::ERR_NAME_NOT_RESOLVED:

'x-csrf-token': config.csrf_token,

It worked!

Just so I can understand, it seems the custom JS area has access to the value of config.csrf_token,
If it was external code, how could I get that config.csrf_token value?

julian

@eeeee hmm, that gets me thinking that you shouldn't need the csrf token if you are passing in a Bearer token. It's supposed to not require it.

I wonder why you're seeing that requirement...

julian

I think I might know why though. Can you do me a favour and update the code to add credentials: 'omit' to options, and then comment out the line adding the csrf token?

I think what is happening is that when fetch() sends the request, it also sends the session cookie. NodeBB checks the session cookie, finds an active session, and uses that user, and ignores the bearer token.

eeeee

I tried that change,
so commented the csrf token line out and put in same place
credentials: 'omit',
Then it gave the
'F' not valid JSON .... error
again

Is headers right place for credentials?
Screenshot_20230712_214705_Chrome~2.jpg

julian

Ah, no, you'll want to put it in options. So, just outside of headers.

Edit: my mistake, in your code above, your variable was called option, singular. Add it to that object.

eeeee

@julian yes, thats fixed it!
Thanks

julian

@eeeee Cool! We both learned something new today.