Better API security about framework

[franzliedke]

How about applying the whitelist principle to API security? Basically disallowing all access by default, so that actions have to be made accessible explicitly based on permissions.

[tobyzerner]

Sounds good to me. I think we'll implement a basic version of the OAuth2 spec, similar to what Ghost have planned. I'll see if I can draft our own detailed plan next week.

[SharpMan]

Saml for having authentification too

[tobyzerner]

We will also need to implement some form of API throttling

[rodrigoargumedo]

Rate-limiting would be best to handle this case. Similar to GitHub API via command line tells how many requests you have left for one minute or two.

How about: If a user does HTTP GET or POST request for a forum thread for one minute via curl and flash the message saying: You have $(api.rate_limit) request left. When exceeded, prompt them to login to expand their rate-limit.

Is this a good approach? I feel this is a great idea but it can be quite a pain and insubstantial if not implemented properly.

[franzliedke]

I'm thinking that should all be part of a separate extension, which could be called public-api. That would then take care of handling rate limits as well as exposing the API to the public (by sending the appropriate Access-Control headers).

[rodrigoargumedo]

Yeah, that makes a lot of sense. Doing its API in separate repository as a extension would be wonderful to implement on.

[tobyzerner]

Sounds good. In any case, we need to implement the whitelisting security for beta. How do we go about doing that?

[tobyzerner]

Thinking about this some more, I'm not sure if there's anything we actually need to do.

The parts requiring authentication are already locked down, as they're inaccessible without an API token (which requires a username/password). But the public endpoints, like http://discuss.flarum.org/api/discussions, need to be accessible without a token so that guests can view the forum. And there's no way to limit their access to just Flarum's web client, because the web client can't keep a secret.

I guess there's nothing really wrong with this anyway. It just makes data mining slightly easier :)

Going to close this now. We can revisit OAuth/public-api later.